From c0af235242c3d8e3f0a7824a863388276c22a643 Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Fri, 6 Nov 2026 02:52:57 +0100
Subject: [PATCH 1/2] refactor(file_storage): follow the module layout (moves
 only)

constants/settings/services/errors, tenant scope, formatting, health, audit
labels, the tenant cache, durable tenant teardown, the object reaper and
worker access -> core/; the stored-file service and its reads, deletes,
visibility, queries, aggregates, downloads, ranges and thumbnails -> files/;
resumable multipart uploads -> multipart/ (a name the repo's uploads/
.gitignore entry does not hide from the wheel); backend_guard ->
backends/guard.py; deps, body limits, serving, CORS, CSP and endpoints ->
web/. Page components, hook and TS helpers move to ui/. tasks.py stays at the
root and Celery task names are unchanged.

TenantStorageCleanupRequested keeps __module__ = "file_storage.tenant_deletion"
so its durable event key (stored in outbox rows) does not change; handler
names stay pinned. file_storage.{settings,service,deps,scope,downloads,
upload_support,tenant_deletion} stay as deprecated sys.modules aliases
(remove_in 0.0.46).

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 CHANGELOG.md                                  |   1 +
 docs/module-layout.md                         |   2 +-
 docs/modules/background_tasks.md              |   2 +-
 host/tests/test_module_layout.py              |  11 +-
 modules/branding/branding/assets/images.py    |   4 +-
 modules/branding/branding/assets/reaper.py    |   2 +-
 modules/branding/branding/core/service.py     |   2 +-
 modules/branding/branding/web/deps.py         |   4 +-
 .../branding/branding/web/endpoints/api.py    |   6 +-
 .../branding/branding/web/endpoints/assets.py |   6 +-
 .../branding/web/endpoints/tenant_api.py      |   4 +-
 .../assets/images/test_branding_logo_dark.py  |   2 +-
 .../reaper/test_branding_asset_lifecycle.py   |   2 +-
 .../tests/core/module/test_branding.py        |   4 +-
 .../test_branding_tenant_branding_assets.py   |   2 +-
 .../endpoints/test_branding_platform_files.py |   2 +-
 .../endpoints/test_branding_public_assets.py  |   2 +-
 modules/file_storage/README.md                |   4 +-
 .../file_storage/backends/__init__.py         |   2 +-
 .../file_storage/backends/filesystem.py       |   4 +-
 .../backends/filesystem_multipart.py          |   2 +-
 .../{backend_guard.py => backends/guard.py}   |   0
 .../file_storage/file_storage/backends/s3.py  |   4 +-
 .../file_storage/backends/s3_put.py           |   5 +-
 .../file_storage/contracts/__init__.py        |   6 +-
 .../file_storage/core/__init__.py             |   6 +
 .../file_storage/{ => core}/audit_labels.py   |   0
 .../file_storage/{ => core}/constants.py      |   0
 .../file_storage/{ => core}/errors.py         |   4 +-
 .../file_storage/{ => core}/format.py         |   0
 .../file_storage/{ => core}/health.py         |   0
 .../file_storage/{ => core}/object_reaper.py  |   3 +-
 .../file_storage/file_storage/core/scope.py   |  72 ++++++
 .../file_storage/{ => core}/services.py       |   4 +-
 .../file_storage/core/settings.py             | 187 +++++++++++++++
 .../file_storage/{ => core}/tenant_cache.py   |   0
 .../file_storage/core/tenant_deletion.py      | 155 +++++++++++++
 .../file_storage/{ => core}/worker.py         |  10 +-
 .../file_storage/{ => core}/worker_support.py |   4 +-
 modules/file_storage/file_storage/deps.py     |  59 +----
 .../file_storage/file_storage/downloads.py    |  64 +-----
 .../file_storage/files/__init__.py            |   5 +
 .../file_storage/{ => files}/aggregates.py    |   0
 .../file_storage/{ => files}/deletes.py       |   8 +-
 .../file_storage/files/downloads.py           |  63 +++++
 .../file_storage/{ => files}/media_types.py   |   6 +-
 .../file_storage/{ => files}/queries.py       |   6 +-
 .../file_storage/{ => files}/ranges.py        |   2 +-
 .../file_storage/{ => files}/reads.py         |  11 +-
 .../file_storage/{ => files}/resolve.py       |   2 +-
 .../file_storage/files/service.py             | 217 ++++++++++++++++++
 .../file_storage/{ => files}/thumbnails.py    |   4 +-
 .../file_storage/{ => files}/visibility.py    |  11 +-
 modules/file_storage/file_storage/models.py   |   2 +-
 modules/file_storage/file_storage/module.py   |  38 +--
 .../file_storage/multipart/__init__.py        |   4 +
 .../file_storage/{ => multipart}/checksum.py  |   2 +-
 .../{upload_guards.py => multipart/guards.py} |  12 +-
 .../{uploads.py => multipart/sessions.py}     |  11 +-
 .../file_storage/multipart/support.py         |  78 +++++++
 .../file_storage/pages/Browse.tsx             |  24 +-
 modules/file_storage/file_storage/scope.py    |  73 +-----
 modules/file_storage/file_storage/service.py  | 217 +-----------------
 modules/file_storage/file_storage/settings.py | 188 +--------------
 modules/file_storage/file_storage/tasks.py    |  10 +-
 .../file_storage/tenant_deletion.py           | 152 +-----------
 .../{pages => ui}/components/BrowseEmpty.tsx  |   0
 .../components/DropzoneStrip.tsx              |   0
 .../components/FileFilterBar.tsx              |   2 +-
 .../{pages => ui}/components/FileTable.tsx    |   6 +-
 .../components/SelectionFooter.tsx            |   2 +-
 .../components/UploadDropzone.tsx             |   0
 .../{pages => ui}/components/UploadsCard.tsx  |   2 +-
 .../{pages => ui/hooks}/use-file-actions.ts   |   6 +-
 .../{pages => ui/utils}/constants.ts          |   0
 .../{pages => ui/utils}/format.ts             |   0
 .../{pages => ui/utils}/resumable-upload.ts   |   0
 .../{pages => ui/utils}/resume-store.ts       |   0
 .../file_storage/{pages => ui/utils}/types.ts |   0
 .../{pages => ui/utils}/upload-errors.ts      |   0
 .../{pages => ui/utils}/upload-queue.ts       |   0
 .../file_storage/upload_support.py            |  81 +------
 .../file_storage/file_storage/web/__init__.py |   6 +
 .../file_storage/{ => web}/body_limits.py     |   4 +-
 .../file_storage/{ => web}/cookieless.py      |   2 +-
 .../file_storage/{ => web}/cors.py            |   4 +-
 .../file_storage/{ => web}/csp.py             |   4 +-
 modules/file_storage/file_storage/web/deps.py |  58 +++++
 .../{ => web}/endpoints/__init__.py           |   0
 .../file_storage/{ => web}/endpoints/api.py   |  19 +-
 .../{ => web}/endpoints/public.py             |  12 +-
 .../{ => web}/endpoints/upload_errors.py      |  10 +-
 .../{ => web}/endpoints/uploads.py            |  36 +--
 .../file_storage/{ => web}/endpoints/views.py |  10 +-
 .../file_storage/{ => web}/serving.py         |  13 +-
 .../file_storage/tests-js/FileTable.test.tsx  |   4 +-
 .../tests-js/SelectionFooter.test.tsx         |   2 +-
 ..._storage_upload_queue_cancellation.test.ts |   6 +-
 ...ile_storage_upload_queue_lifecycle.test.ts |   6 +-
 .../file_storage_useFileActions.test.tsx      |   4 +-
 modules/file_storage/tests-js/format.test.ts  |   2 +-
 .../tests-js/resumable-queue.test.ts          |   6 +-
 .../tests-js/resumable-upload.test.ts         |   6 +-
 .../tests-js/upload-queue.test.ts             |   2 +-
 ...rs.py => _file_storage_uploads_support.py} |   2 +-
 ...ers.py => _file_storage_worker_support.py} |   0
 .../test_file_storage_filesystem_backend.py}  |   2 +-
 ..._file_storage_filesystem_stale_objects.py} |   2 +-
 .../test_file_storage_upload_io.py            |   0
 .../test_file_storage_backend_mismatch.py     |  11 +-
 .../test_file_storage_backend_registry.py}    |   6 +-
 .../s3/test_file_storage_s3_backend.py}       |  10 +-
 modules/file_storage/tests/conftest.py        |   8 +-
 .../format/test_file_storage_format.py}       |   2 +-
 .../test_file_storage_menu_permission.py      |   2 +-
 .../test_file_storage_optional_ordering.py    |   0
 ...t_file_storage_without_background_tasks.py |   2 +-
 .../test_file_storage_quota_setting.py        |   4 +-
 .../test_file_storage_restart_settings.py     |   4 +-
 .../test_file_storage_platform_scope.py}      |   4 +-
 .../tenancy}/test_file_storage_tenancy.py     |   4 +-
 .../test_file_storage_tenancy_unbound.py      |   6 +-
 .../test_file_storage_tenant_migration.py     |   2 +-
 .../test_file_storage_cleanup_chunks.py       |   6 +-
 .../test_file_storage_tenant_deletion.py      |  26 ++-
 .../test_file_storage_object_reaper.py        |   2 +-
 .../worker}/test_file_storage_upload_tasks.py |   7 +-
 .../worker}/test_file_storage_worker.py       |  12 +-
 .../test_file_storage_worker_failures.py      |   4 +-
 .../browse/test_file_storage_aggregates.py}   |   4 +-
 .../browse}/test_file_storage_browse_index.py |   4 +-
 .../browse/test_file_storage_browse_props.py} |   2 +-
 .../test_file_storage_browse_query_shape.py}  |   2 +-
 .../browse}/test_file_storage_filters.py      |   6 +-
 .../test_file_storage_uploader_directory.py   |   2 +-
 .../test_file_storage_uploader_filter.py}     |   6 +-
 .../deletes/test_file_storage_bulk_delete.py} |   6 +-
 ...t_file_storage_delete_permission_modes.py} |   2 +-
 .../media}/test_file_storage_media_types.py   |   4 +-
 .../media}/test_file_storage_range_parse.py   |   4 +-
 .../test_file_storage_thumbnail_hardening.py  |   3 +-
 ..._file_storage_thumbnail_session_release.py |   5 +-
 .../media}/test_file_storage_thumbnails.py    |   3 +-
 .../test_file_storage_commit_cleanup.py       |   2 +-
 .../test_file_storage_delete_variants.py      |   7 +-
 .../service}/test_file_storage_owner_scope.py |   4 +-
 .../service/test_file_storage_service.py}     |   8 +-
 .../service}/test_file_storage_timestamps.py  |   2 +-
 ...st_file_storage_checksum_reconciliation.py |   3 +-
 .../test_file_storage_p3_scope_usage.py       |   4 +-
 .../guards}/test_file_storage_plain_quota.py  |  10 +-
 .../guards}/test_file_storage_server_put.py   |   6 +-
 ...test_file_storage_upload_failure_modes.py} |   8 +-
 .../test_file_storage_upload_guards.py        |   8 +-
 .../test_file_storage_busy_admission.py       |   5 +-
 ...test_file_storage_sqlite_admission_race.py |   8 +-
 .../test_file_storage_uploads_expiry.py       |   4 +-
 .../sessions}/test_file_storage_uploads_fs.py |  14 +-
 .../test_file_storage_uploads_minio.py        |   6 +-
 .../sessions}/test_file_storage_uploads_pg.py |   4 +-
 .../test_file_storage_uploads_quota.py        |   4 +-
 .../sessions}/test_file_storage_uploads_s3.py |   8 +-
 .../api/test_file_storage_api.py}             |   2 +-
 .../api}/test_file_storage_deps_backend.py    |   4 +-
 ...le_storage_files_api_pagination_bounds.py} |   2 +-
 .../api}/test_file_storage_page_clamp.py      |   2 +-
 ...test_file_storage_deleted_tenant_public.py |  12 +-
 .../test_file_storage_p3_download_csp.py      |   4 +-
 .../public}/test_file_storage_public.py       |   2 +-
 .../test_file_storage_public_cookieless.py    |   2 +-
 .../public}/test_file_storage_public_cors.py  |   2 +-
 .../public}/test_file_storage_public_rate.py  |   2 +-
 .../test_file_storage_range_download.py       |   2 +-
 .../test_file_storage_single_tenant_public.py |   2 +-
 .../fields/test_settings_field_sources.py     |   4 +-
 ...tings_lenient_related_fields_validators.py |   2 +-
 .../test_settings_module_api_json_fields.py   |   2 +-
 .../test_tenants_teardown_integration.py      |   2 +-
 178 files changed, 1295 insertions(+), 1163 deletions(-)
 rename modules/file_storage/file_storage/{backend_guard.py => backends/guard.py} (100%)
 create mode 100644 modules/file_storage/file_storage/core/__init__.py
 rename modules/file_storage/file_storage/{ => core}/audit_labels.py (100%)
 rename modules/file_storage/file_storage/{ => core}/constants.py (100%)
 rename modules/file_storage/file_storage/{ => core}/errors.py (88%)
 rename modules/file_storage/file_storage/{ => core}/format.py (100%)
 rename modules/file_storage/file_storage/{ => core}/health.py (100%)
 rename modules/file_storage/file_storage/{ => core}/object_reaper.py (97%)
 create mode 100644 modules/file_storage/file_storage/core/scope.py
 rename modules/file_storage/file_storage/{ => core}/services.py (90%)
 create mode 100644 modules/file_storage/file_storage/core/settings.py
 rename modules/file_storage/file_storage/{ => core}/tenant_cache.py (100%)
 create mode 100644 modules/file_storage/file_storage/core/tenant_deletion.py
 rename modules/file_storage/file_storage/{ => core}/worker.py (95%)
 rename modules/file_storage/file_storage/{ => core}/worker_support.py (81%)
 create mode 100644 modules/file_storage/file_storage/files/__init__.py
 rename modules/file_storage/file_storage/{ => files}/aggregates.py (100%)
 rename modules/file_storage/file_storage/{ => files}/deletes.py (95%)
 create mode 100644 modules/file_storage/file_storage/files/downloads.py
 rename modules/file_storage/file_storage/{ => files}/media_types.py (92%)
 rename modules/file_storage/file_storage/{ => files}/queries.py (97%)
 rename modules/file_storage/file_storage/{ => files}/ranges.py (98%)
 rename modules/file_storage/file_storage/{ => files}/reads.py (89%)
 rename modules/file_storage/file_storage/{ => files}/resolve.py (96%)
 create mode 100644 modules/file_storage/file_storage/files/service.py
 rename modules/file_storage/file_storage/{ => files}/thumbnails.py (98%)
 rename modules/file_storage/file_storage/{ => files}/visibility.py (92%)
 create mode 100644 modules/file_storage/file_storage/multipart/__init__.py
 rename modules/file_storage/file_storage/{ => multipart}/checksum.py (98%)
 rename modules/file_storage/file_storage/{upload_guards.py => multipart/guards.py} (93%)
 rename modules/file_storage/file_storage/{uploads.py => multipart/sessions.py} (97%)
 create mode 100644 modules/file_storage/file_storage/multipart/support.py
 rename modules/file_storage/file_storage/{pages => ui}/components/BrowseEmpty.tsx (100%)
 rename modules/file_storage/file_storage/{pages => ui}/components/DropzoneStrip.tsx (100%)
 rename modules/file_storage/file_storage/{pages => ui}/components/FileFilterBar.tsx (99%)
 rename modules/file_storage/file_storage/{pages => ui}/components/FileTable.tsx (97%)
 rename modules/file_storage/file_storage/{pages => ui}/components/SelectionFooter.tsx (97%)
 rename modules/file_storage/file_storage/{pages => ui}/components/UploadDropzone.tsx (100%)
 rename modules/file_storage/file_storage/{pages => ui}/components/UploadsCard.tsx (98%)
 rename modules/file_storage/file_storage/{pages => ui/hooks}/use-file-actions.ts (95%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/constants.ts (100%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/format.ts (100%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/resumable-upload.ts (100%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/resume-store.ts (100%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/types.ts (100%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/upload-errors.ts (100%)
 rename modules/file_storage/file_storage/{pages => ui/utils}/upload-queue.ts (100%)
 create mode 100644 modules/file_storage/file_storage/web/__init__.py
 rename modules/file_storage/file_storage/{ => web}/body_limits.py (92%)
 rename modules/file_storage/file_storage/{ => web}/cookieless.py (98%)
 rename modules/file_storage/file_storage/{ => web}/cors.py (93%)
 rename modules/file_storage/file_storage/{ => web}/csp.py (92%)
 create mode 100644 modules/file_storage/file_storage/web/deps.py
 rename modules/file_storage/file_storage/{ => web}/endpoints/__init__.py (100%)
 rename modules/file_storage/file_storage/{ => web}/endpoints/api.py (93%)
 rename modules/file_storage/file_storage/{ => web}/endpoints/public.py (89%)
 rename modules/file_storage/file_storage/{ => web}/endpoints/upload_errors.py (90%)
 rename modules/file_storage/file_storage/{ => web}/endpoints/uploads.py (94%)
 rename modules/file_storage/file_storage/{ => web}/endpoints/views.py (95%)
 rename modules/file_storage/file_storage/{ => web}/serving.py (92%)
 rename modules/file_storage/tests/{file_storage_uploads_helpers.py => _file_storage_uploads_support.py} (97%)
 rename modules/file_storage/tests/{file_storage_worker_helpers.py => _file_storage_worker_support.py} (100%)
 rename modules/file_storage/tests/{test_filesystem_backend.py => backends/filesystem/test_file_storage_filesystem_backend.py} (98%)
 rename modules/file_storage/tests/{test_filesystem_stale_objects.py => backends/filesystem/test_file_storage_filesystem_stale_objects.py} (97%)
 rename modules/file_storage/tests/{ => backends/filesystem}/test_file_storage_upload_io.py (100%)
 rename modules/file_storage/tests/{ => backends/registry}/test_file_storage_backend_mismatch.py (91%)
 rename modules/file_storage/tests/{test_backend_registry.py => backends/registry/test_file_storage_backend_registry.py} (95%)
 rename modules/file_storage/tests/{test_s3_backend.py => backends/s3/test_file_storage_s3_backend.py} (96%)
 rename modules/file_storage/tests/{test_format.py => core/format/test_file_storage_format.py} (95%)
 rename modules/file_storage/tests/{ => core/module}/test_file_storage_menu_permission.py (90%)
 rename modules/file_storage/tests/{ => core/module}/test_file_storage_optional_ordering.py (100%)
 rename modules/file_storage/tests/{ => core/module}/test_file_storage_without_background_tasks.py (95%)
 rename modules/file_storage/tests/{ => core/settings}/test_file_storage_quota_setting.py (91%)
 rename modules/file_storage/tests/{ => core/settings}/test_file_storage_restart_settings.py (95%)
 rename modules/file_storage/tests/{test_platform_scope.py => core/tenancy/test_file_storage_platform_scope.py} (97%)
 rename modules/file_storage/tests/{ => core/tenancy}/test_file_storage_tenancy.py (98%)
 rename modules/file_storage/tests/{ => core/tenancy}/test_file_storage_tenancy_unbound.py (96%)
 rename modules/file_storage/tests/{ => core/tenancy}/test_file_storage_tenant_migration.py (98%)
 rename modules/file_storage/tests/{ => core/tenant_deletion}/test_file_storage_cleanup_chunks.py (91%)
 rename modules/file_storage/tests/{ => core/tenant_deletion}/test_file_storage_tenant_deletion.py (90%)
 rename modules/file_storage/tests/{ => core/worker}/test_file_storage_object_reaper.py (96%)
 rename modules/file_storage/tests/{ => core/worker}/test_file_storage_upload_tasks.py (97%)
 rename modules/file_storage/tests/{ => core/worker}/test_file_storage_worker.py (96%)
 rename modules/file_storage/tests/{ => core/worker}/test_file_storage_worker_failures.py (98%)
 rename modules/file_storage/tests/{test_aggregates.py => files/browse/test_file_storage_aggregates.py} (98%)
 rename modules/file_storage/tests/{ => files/browse}/test_file_storage_browse_index.py (96%)
 rename modules/file_storage/tests/{test_browse_props.py => files/browse/test_file_storage_browse_props.py} (99%)
 rename modules/file_storage/tests/{test_browse_query_shape.py => files/browse/test_file_storage_browse_query_shape.py} (99%)
 rename modules/file_storage/tests/{ => files/browse}/test_file_storage_filters.py (96%)
 rename modules/file_storage/tests/{ => files/browse}/test_file_storage_uploader_directory.py (92%)
 rename modules/file_storage/tests/{test_uploader_filter.py => files/browse/test_file_storage_uploader_filter.py} (96%)
 rename modules/file_storage/tests/{test_bulk_delete.py => files/deletes/test_file_storage_bulk_delete.py} (97%)
 rename modules/file_storage/tests/{test_delete_permission_modes.py => files/deletes/test_file_storage_delete_permission_modes.py} (93%)
 rename modules/file_storage/tests/{ => files/media}/test_file_storage_media_types.py (95%)
 rename modules/file_storage/tests/{ => files/media}/test_file_storage_range_parse.py (94%)
 rename modules/file_storage/tests/{ => files/media}/test_file_storage_thumbnail_hardening.py (98%)
 rename modules/file_storage/tests/{ => files/media}/test_file_storage_thumbnail_session_release.py (94%)
 rename modules/file_storage/tests/{ => files/media}/test_file_storage_thumbnails.py (98%)
 rename modules/file_storage/tests/{ => files/service}/test_file_storage_commit_cleanup.py (97%)
 rename modules/file_storage/tests/{ => files/service}/test_file_storage_delete_variants.py (90%)
 rename modules/file_storage/tests/{ => files/service}/test_file_storage_owner_scope.py (98%)
 rename modules/file_storage/tests/{test_service.py => files/service/test_file_storage_service.py} (98%)
 rename modules/file_storage/tests/{ => files/service}/test_file_storage_timestamps.py (96%)
 rename modules/file_storage/tests/{ => multipart/guards}/test_file_storage_checksum_reconciliation.py (98%)
 rename modules/file_storage/tests/{ => multipart/guards}/test_file_storage_p3_scope_usage.py (94%)
 rename modules/file_storage/tests/{ => multipart/guards}/test_file_storage_plain_quota.py (88%)
 rename modules/file_storage/tests/{ => multipart/guards}/test_file_storage_server_put.py (97%)
 rename modules/file_storage/tests/{test_upload_failure_modes.py => multipart/guards/test_file_storage_upload_failure_modes.py} (95%)
 rename modules/file_storage/tests/{ => multipart/guards}/test_file_storage_upload_guards.py (97%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_busy_admission.py (85%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_sqlite_admission_race.py (93%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_uploads_expiry.py (95%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_uploads_fs.py (98%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_uploads_minio.py (94%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_uploads_pg.py (95%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_uploads_quota.py (97%)
 rename modules/file_storage/tests/{ => multipart/sessions}/test_file_storage_uploads_s3.py (97%)
 rename modules/file_storage/tests/{test_api.py => web/api/test_file_storage_api.py} (99%)
 rename modules/file_storage/tests/{ => web/api}/test_file_storage_deps_backend.py (73%)
 rename modules/file_storage/tests/{test_files_api_pagination_bounds.py => web/api/test_file_storage_files_api_pagination_bounds.py} (94%)
 rename modules/file_storage/tests/{ => web/api}/test_file_storage_page_clamp.py (98%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_deleted_tenant_public.py (89%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_p3_download_csp.py (92%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_public.py (99%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_public_cookieless.py (98%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_public_cors.py (97%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_public_rate.py (91%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_range_download.py (99%)
 rename modules/file_storage/tests/{ => web/public}/test_file_storage_single_tenant_public.py (96%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ac3e6c3d..451c1517c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -96,6 +96,7 @@ All notable changes to this project are documented in this file. The format is b
 - `audit_log` follows the module layout: `audit_log.core.{constants,settings,services,capture}`, `audit_log.entries.{service,filters,resolve,activity,export}`, `audit_log.web.{deps,endpoints}`, and the page components move from `pages/components/` to `ui/components/`. The `simple_module.audit_sinks` entry point now targets `audit_log.core.capture:audit_callback`. Nothing outside the module imported the old paths, so no aliases remain.
 - `auth` follows the module layout: `auth.core.{constants,state}` and `auth.web.{deps,middleware}`; `auth.oidc_common` stays as a declared domain area. `auth.constants`, `auth.state`, `auth.deps` and `auth.middleware` still import, with a `DeprecationWarning`, until 0.0.46.
 - `tenants` follows the module layout: `tenants.core.{constants,settings,services,errors,service,user_cleanup}` (with the membership, owner-guard and deletion helpers), `tenants.resolution.{resolver,host_resolver,token_tenant}`, `tenants.invitations.{service,mail}`, `tenants.web.{deps,shared_props,endpoints}`, and the page components and hooks move to `ui/components` and `ui/hooks`. The invitation mail template moves to `invitations/templates/invitation.txt`. `tenants.constants`, `tenants.errors`, `tenants.host_resolver`, `tenants.resolver`, `tenants.service` and `tenants.deps` still import, with a `DeprecationWarning`, until 0.0.46. The durable handler names `tenants.user_cleanup.purge_user_memberships` and `tenants.send_invitation_email` are unchanged.
+- `file_storage` follows the module layout: `file_storage.core.{constants,settings,services,errors,scope,format,health,audit_labels,tenant_cache,tenant_deletion,object_reaper,worker,worker_support}`, `file_storage.files.*`, `file_storage.multipart.{sessions,guards,support,checksum}`, `file_storage.backends.guard`, `file_storage.web.{deps,serving,cors,csp,cookieless,body_limits,endpoints}`, and the page components, hook and helpers move to `ui/`. `file_storage.settings`, `.service`, `.deps`, `.scope`, `.downloads`, `.upload_support` and `.tenant_deletion` still import, with a `DeprecationWarning`, until 0.0.46. The durable `TenantStorageCleanupRequested` event key and its handler names, and the Celery task names, are unchanged.
 
 
 - Coalesce concurrent tenant membership and permission grant cache misses. In-flight invalidation retries against fresh authorization data; failures and cancellation release waiting readers. Cache unknown tenant subdomains for five seconds and drop the new slug's host lookups (on a new `tenants.hosts` invalidation channel, so no user id is read as a slug) and the owner's memberships after committed tenant creation; other users' caches are not cleared. Services built outside request dependencies pass `invalidate_hosts=make_host_invalidator(app)` beside `invalidate=make_invalidator(app)`. Retries after concurrent invalidation are bounded to three reads (2026-11-05 local performance review).
diff --git a/docs/module-layout.md b/docs/module-layout.md
index e06c219b4..6084d5658 100644
--- a/docs/module-layout.md
+++ b/docs/module-layout.md
@@ -219,7 +219,7 @@ when a later module PR moves files.
 | branding | 2 (+6 shims) | 0 | follows this layout |
 | dashboard | 2 | 0 | follows this layout |
 | feature_flags | 3 (+1 shim) | 0 | follows this layout |
-| file_storage | 39 | 65 | flat |
+| file_storage | 4 (+7 shims) | 0 | follows this layout |
 | keycloak | 3 (+5 shims) | 0 | follows this layout |
 | mail | 2 (+2 shims) | 0 | follows this layout |
 | oidc | 3 (+3 shims) | 0 | follows this layout |
diff --git a/docs/modules/background_tasks.md b/docs/modules/background_tasks.md
index bb489ba57..23a933f5a 100644
--- a/docs/modules/background_tasks.md
+++ b/docs/modules/background_tasks.md
@@ -678,7 +678,7 @@ Workers never run the hosting lifespan, so `FileStorageSettings()` (or any `DbBa
 
 ```python
 from background_tasks import settings_for
-from file_storage.settings import FileStorageSettings
+from file_storage.core.settings import FileStorageSettings
 
 
 @celery.task
diff --git a/host/tests/test_module_layout.py b/host/tests/test_module_layout.py
index a3627a7dc..7cdd36b9e 100644
--- a/host/tests/test_module_layout.py
+++ b/host/tests/test_module_layout.py
@@ -37,6 +37,7 @@
     "audit_log": frozenset({"entries"}),
     "auth": frozenset({"oidc_common"}),
     "branding": frozenset({"assets"}),
+    "file_storage": frozenset({"backends", "files", "multipart"}),
     "keycloak": frozenset({"identity"}),
     "mail": frozenset({"delivery"}),
     "oidc": frozenset({"identity"}),
@@ -68,16 +69,6 @@
         workers_state.py
         """.split()
     ),
-    "file_storage": frozenset(
-        """
-        aggregates.py audit_labels.py backend_guard.py backends body_limits.py checksum.py
-        constants.py cookieless.py cors.py csp.py deletes.py deps.py downloads.py endpoints
-        errors.py format.py health.py media_types.py object_reaper.py queries.py ranges.py
-        reads.py resolve.py scope.py service.py services.py serving.py settings.py
-        tenant_cache.py tenant_deletion.py thumbnails.py upload_guards.py upload_support.py
-        uploads.py visibility.py worker.py worker_support.py
-        """.split()
-    ),
     "users": frozenset(
         """
         admin administrators.py audit.py auth_local backend.py bootstrap.py constants.py
diff --git a/modules/branding/branding/assets/images.py b/modules/branding/branding/assets/images.py
index eb1323631..0c9c39aa8 100644
--- a/modules/branding/branding/assets/images.py
+++ b/modules/branding/branding/assets/images.py
@@ -18,7 +18,7 @@
 
 if TYPE_CHECKING:
     from file_storage.contracts.schemas import StoredFileOut
-    from file_storage.service import FileStorageService
+    from file_storage.files.service import FileStorageService
 
 # Raster + icon only. SVG is excluded on purpose: it is an XML document that can
 # carry <script>, so serving one back from our own origin would be stored XSS.
@@ -111,7 +111,7 @@ async def store_image(
     maps the refusal to 413, but branding calls the service directly, so an
     unmapped ``QuotaExceededError`` would surface as a 500.
     """
-    from file_storage.upload_support import QuotaExceededError
+    from file_storage.multipart.support import QuotaExceededError
 
     try:
         return await storage.upload(file, platform=platform)
diff --git a/modules/branding/branding/assets/reaper.py b/modules/branding/branding/assets/reaper.py
index 69c0c3c0e..fc6f44fe0 100644
--- a/modules/branding/branding/assets/reaper.py
+++ b/modules/branding/branding/assets/reaper.py
@@ -58,7 +58,7 @@ def schedule_reap(app: FastAPI, db: AsyncSession, file_id: str, *, tenant_id: st
 
 
 async def reap(app: FastAPI, file_id: str, *, tenant_id: str | None) -> None:
-    from file_storage.service import FileStorageService
+    from file_storage.files.service import FileStorageService
 
     try:
         parsed = uuid.UUID(file_id)
diff --git a/modules/branding/branding/core/service.py b/modules/branding/branding/core/service.py
index 0bafa1967..b3ddcd86e 100644
--- a/modules/branding/branding/core/service.py
+++ b/modules/branding/branding/core/service.py
@@ -23,7 +23,7 @@
 
 if TYPE_CHECKING:
     from fastapi import FastAPI
-    from file_storage.service import FileStorageService
+    from file_storage.files.service import FileStorageService
     from sqlalchemy.ext.asyncio import AsyncSession
 
     from branding.core.settings import BrandingSettings
diff --git a/modules/branding/branding/web/deps.py b/modules/branding/branding/web/deps.py
index 58405b7ab..30c252f7e 100644
--- a/modules/branding/branding/web/deps.py
+++ b/modules/branding/branding/web/deps.py
@@ -5,8 +5,8 @@
 from typing import Annotated
 
 from fastapi import Depends, Request
-from file_storage.deps import get_file_storage_service
-from file_storage.service import FileStorageService
+from file_storage.files.service import FileStorageService
+from file_storage.web.deps import get_file_storage_service
 from simple_module_db.deps import get_db
 from sqlalchemy.ext.asyncio import AsyncSession
 
diff --git a/modules/branding/branding/web/endpoints/api.py b/modules/branding/branding/web/endpoints/api.py
index b012b364e..01c2618d9 100644
--- a/modules/branding/branding/web/endpoints/api.py
+++ b/modules/branding/branding/web/endpoints/api.py
@@ -3,8 +3,8 @@
 from __future__ import annotations
 
 from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile
-from file_storage.deps import get_file_storage_service
-from file_storage.service import FileStorageService
+from file_storage.files.service import FileStorageService
+from file_storage.web.deps import get_file_storage_service
 from simple_module_core.app_state import get_design_packs
 from simple_module_hosting.permissions import RequiresPermission
 
@@ -18,7 +18,7 @@
 
 # Branding images are uploaded with ``platform=True``: they are the install's,
 # not the uploading admin's active organisation's, and the anonymous asset
-# routes must find them with no tenant bound (see ``file_storage.scope``).
+# routes must find them with no tenant bound (see ``file_storage.core.scope``).
 
 _MANAGE = Depends(RequiresPermission(constants.PERM_MANAGE))
 
diff --git a/modules/branding/branding/web/endpoints/assets.py b/modules/branding/branding/web/endpoints/assets.py
index 77728c60b..3987084fa 100644
--- a/modules/branding/branding/web/endpoints/assets.py
+++ b/modules/branding/branding/web/endpoints/assets.py
@@ -13,7 +13,7 @@
   ``tenant_context(tenant)``, so only a row the tenant owns matches;
 * a **system** value is read as a *platform* file (``platform=True``): an
   ``all_tenants()`` lookup restricted to rows owned by
-  ``file_storage.scope.PLATFORM_TENANT_ID``.
+  ``file_storage.core.scope.PLATFORM_TENANT_ID``.
 
 Either way a setting pointed at someone else's file id serves a 404, never
 their file.
@@ -26,13 +26,13 @@
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import RedirectResponse, StreamingResponse
-from file_storage.deps import get_file_storage_service
-from file_storage.service import (
+from file_storage.files.service import (
     FileStorageService,
     RedirectDownload,
     StoredFileNotFoundError,
     StreamDownload,
 )
+from file_storage.web.deps import get_file_storage_service
 from simple_module_db import tenant_context
 
 from branding.assets.images import ALLOWED_IMAGE_TYPES, normalize_content_type
diff --git a/modules/branding/branding/web/endpoints/tenant_api.py b/modules/branding/branding/web/endpoints/tenant_api.py
index 64d19d9c8..db48aebb0 100644
--- a/modules/branding/branding/web/endpoints/tenant_api.py
+++ b/modules/branding/branding/web/endpoints/tenant_api.py
@@ -16,8 +16,8 @@
 from __future__ import annotations
 
 from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile
-from file_storage.deps import get_file_storage_service
-from file_storage.service import FileStorageService
+from file_storage.files.service import FileStorageService
+from file_storage.web.deps import get_file_storage_service
 from settings.contracts.schemas import SettingScope, SettingUpsert
 from settings.core.constants import PERM_TENANT_EDIT
 from settings.core.service import SettingService
diff --git a/modules/branding/tests/assets/images/test_branding_logo_dark.py b/modules/branding/tests/assets/images/test_branding_logo_dark.py
index 9e3027606..db0a5265e 100644
--- a/modules/branding/tests/assets/images/test_branding_logo_dark.py
+++ b/modules/branding/tests/assets/images/test_branding_logo_dark.py
@@ -21,8 +21,8 @@
 import pytest
 from branding.core.settings import BrandingSettings
 from branding.web.shared_props import branding_payload
+from file_storage.files.service import FileStorageService, StreamDownload
 from file_storage.models import StoredFile
-from file_storage.service import FileStorageService, StreamDownload
 
 _PNG = b"\x89PNG\r\n\x1a\n" + b"\x00" * 32
 
diff --git a/modules/branding/tests/assets/reaper/test_branding_asset_lifecycle.py b/modules/branding/tests/assets/reaper/test_branding_asset_lifecycle.py
index 86df2ef48..3c17cc96c 100644
--- a/modules/branding/tests/assets/reaper/test_branding_asset_lifecycle.py
+++ b/modules/branding/tests/assets/reaper/test_branding_asset_lifecycle.py
@@ -14,8 +14,8 @@
 
 import httpx
 import pytest
+from file_storage.files.service import FileStorageService, StoredFileNotFoundError
 from file_storage.models import StoredFile
-from file_storage.service import FileStorageService, StoredFileNotFoundError
 
 _PNG = b"\x89PNG\r\n\x1a\n" + b"\x00" * 32
 
diff --git a/modules/branding/tests/core/module/test_branding.py b/modules/branding/tests/core/module/test_branding.py
index 37f6bf080..877d97895 100644
--- a/modules/branding/tests/core/module/test_branding.py
+++ b/modules/branding/tests/core/module/test_branding.py
@@ -204,7 +204,9 @@ async def fake_upload(self, upload, *, platform: bool = False):
         assert platform, "branding must act on platform-owned files"
         return SimpleNamespace(id=fake_id)
 
-    monkeypatch.setattr("file_storage.service.FileStorageService.upload", fake_upload, raising=True)
+    monkeypatch.setattr(
+        "file_storage.files.service.FileStorageService.upload", fake_upload, raising=True
+    )
 
     resp = await authenticated_client.post(
         "/api/branding/logo",
diff --git a/modules/branding/tests/core/tenant_branding/test_branding_tenant_branding_assets.py b/modules/branding/tests/core/tenant_branding/test_branding_tenant_branding_assets.py
index 5680f469f..4911a4a64 100644
--- a/modules/branding/tests/core/tenant_branding/test_branding_tenant_branding_assets.py
+++ b/modules/branding/tests/core/tenant_branding/test_branding_tenant_branding_assets.py
@@ -12,8 +12,8 @@
 import pytest
 from branding.core import tenant_branding
 from branding.core.constants import LOGO_URL
+from file_storage.core.scope import PLATFORM_TENANT_ID
 from file_storage.models import StoredFile
-from file_storage.scope import PLATFORM_TENANT_ID
 from settings.contracts.schemas import SettingScope, SettingUpsert
 from settings.core.service import SettingService
 from simple_module_db import all_tenants
diff --git a/modules/branding/tests/web/endpoints/test_branding_platform_files.py b/modules/branding/tests/web/endpoints/test_branding_platform_files.py
index c38dc9fb7..67c58870d 100644
--- a/modules/branding/tests/web/endpoints/test_branding_platform_files.py
+++ b/modules/branding/tests/web/endpoints/test_branding_platform_files.py
@@ -15,8 +15,8 @@
 import httpx
 import pytest
 from branding.core.constants import LOGO_URL
+from file_storage.core.scope import PLATFORM_TENANT_ID
 from file_storage.models import StoredFile
-from file_storage.scope import PLATFORM_TENANT_ID
 from simple_module_db import all_tenants
 from sqlalchemy import select
 
diff --git a/modules/branding/tests/web/endpoints/test_branding_public_assets.py b/modules/branding/tests/web/endpoints/test_branding_public_assets.py
index da5a8d9e6..48aee940c 100644
--- a/modules/branding/tests/web/endpoints/test_branding_public_assets.py
+++ b/modules/branding/tests/web/endpoints/test_branding_public_assets.py
@@ -17,8 +17,8 @@
 
 import httpx
 import pytest
+from file_storage.files.service import FileStorageService, StreamDownload
 from file_storage.models import StoredFile
-from file_storage.service import FileStorageService, StreamDownload
 
 _PNG = b"\x89PNG\r\n\x1a\n" + b"\x00" * 32
 
diff --git a/modules/file_storage/README.md b/modules/file_storage/README.md
index 03df0efe6..0d044a37f 100644
--- a/modules/file_storage/README.md
+++ b/modules/file_storage/README.md
@@ -52,8 +52,8 @@ From another module, inject the service via its dependency:
 ```python
 from fastapi import Depends, File, UploadFile
 
-from file_storage.deps import get_file_storage_service
-from file_storage.service import FileStorageService
+from file_storage.web.deps import get_file_storage_service
+from file_storage.files.service import FileStorageService
 
 
 async def attach_receipt(
diff --git a/modules/file_storage/file_storage/backends/__init__.py b/modules/file_storage/file_storage/backends/__init__.py
index 02ecf40ff..7dbbd9f85 100644
--- a/modules/file_storage/file_storage/backends/__init__.py
+++ b/modules/file_storage/file_storage/backends/__init__.py
@@ -26,7 +26,7 @@ class with extra fields). :func:`build_backend` resolves the active
 
 if TYPE_CHECKING:
     from file_storage.contracts.service import StorageBackend
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
 
 BackendFactory = Callable[["FileStorageSettings"], "StorageBackend"]
 
diff --git a/modules/file_storage/file_storage/backends/filesystem.py b/modules/file_storage/file_storage/backends/filesystem.py
index f583df97a..67909b9b2 100644
--- a/modules/file_storage/file_storage/backends/filesystem.py
+++ b/modules/file_storage/file_storage/backends/filesystem.py
@@ -12,7 +12,6 @@
 
 import aiofiles
 
-from file_storage import constants
 from file_storage.backends import register_backend
 from file_storage.backends.filesystem_multipart import FilesystemMultipartMixin
 from file_storage.contracts.service import (
@@ -20,7 +19,8 @@
     StorageBackendError,
     StorageNotFoundError,
 )
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 
 
 class FilesystemBackend(FilesystemMultipartMixin):
diff --git a/modules/file_storage/file_storage/backends/filesystem_multipart.py b/modules/file_storage/file_storage/backends/filesystem_multipart.py
index 3124faf1d..18dda8f0e 100644
--- a/modules/file_storage/file_storage/backends/filesystem_multipart.py
+++ b/modules/file_storage/file_storage/backends/filesystem_multipart.py
@@ -18,7 +18,6 @@
 
 import aiofiles
 
-from file_storage import constants
 from file_storage.contracts.service import (
     NotSupportedError,
     ObjectInfo,
@@ -26,6 +25,7 @@
     StorageBackendError,
     StorageNotFoundError,
 )
+from file_storage.core import constants
 
 _UPLOAD_ID = re.compile(r"^[0-9a-f]{32}$")
 _ETAG_SUFFIX = ".etag"
diff --git a/modules/file_storage/file_storage/backend_guard.py b/modules/file_storage/file_storage/backends/guard.py
similarity index 100%
rename from modules/file_storage/file_storage/backend_guard.py
rename to modules/file_storage/file_storage/backends/guard.py
diff --git a/modules/file_storage/file_storage/backends/s3.py b/modules/file_storage/file_storage/backends/s3.py
index 4f8c088f2..2fc0ed550 100644
--- a/modules/file_storage/file_storage/backends/s3.py
+++ b/modules/file_storage/file_storage/backends/s3.py
@@ -11,7 +11,6 @@
 from datetime import datetime
 from typing import Any
 
-from file_storage import constants
 from file_storage.backends import register_backend
 from file_storage.backends.s3_multipart import S3MultipartMixin
 from file_storage.contracts.service import (
@@ -20,7 +19,8 @@
     StorageError,
     StorageNotFoundError,
 )
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 
 _MISSING_S3_EXTRA = (
     "S3 backend requires the 'aioboto3' package. Install with: uv add --optional s3 aioboto3"
diff --git a/modules/file_storage/file_storage/backends/s3_put.py b/modules/file_storage/file_storage/backends/s3_put.py
index 3c1b7ed4e..82332e3a2 100644
--- a/modules/file_storage/file_storage/backends/s3_put.py
+++ b/modules/file_storage/file_storage/backends/s3_put.py
@@ -8,9 +8,10 @@
 from tempfile import SpooledTemporaryFile
 from typing import TYPE_CHECKING, Any
 
-from file_storage import constants, upload_support
 from file_storage.contracts.service import Part, StorageBackendError
-from file_storage.upload_support import SizeMismatchError
+from file_storage.core import constants
+from file_storage.multipart import support as upload_support
+from file_storage.multipart.support import SizeMismatchError
 
 if TYPE_CHECKING:
     from file_storage.backends.s3 import S3Backend
diff --git a/modules/file_storage/file_storage/contracts/__init__.py b/modules/file_storage/file_storage/contracts/__init__.py
index 8844f81ea..c0c2357d6 100644
--- a/modules/file_storage/file_storage/contracts/__init__.py
+++ b/modules/file_storage/file_storage/contracts/__init__.py
@@ -50,20 +50,20 @@ def store_path(
     public: bool = False,
 ) -> StoredFileOut:
     """Store a path or stream in the caller's tenant, in an independent transaction."""
-    from file_storage.worker import store_path as store
+    from file_storage.core.worker import store_path as store
 
     return store(source, filename=filename, content_type=content_type, public=public)
 
 
 def open_local(file_id: UUID) -> AbstractContextManager[Path]:
     """Download to a private local path for the lifetime of this context."""
-    from file_storage.worker import open_local as local
+    from file_storage.core.worker import open_local as local
 
     return local(file_id)
 
 
 def presigned_url(file_id: UUID, *, ttl_seconds: int | None = None) -> str:
     """Return a scoped download URL; unsupported backends raise NotSupportedError."""
-    from file_storage.worker import presigned_url as sign
+    from file_storage.core.worker import presigned_url as sign
 
     return sign(file_id, ttl_seconds=ttl_seconds)
diff --git a/modules/file_storage/file_storage/core/__init__.py b/modules/file_storage/file_storage/core/__init__.py
new file mode 100644
index 000000000..f3df6413f
--- /dev/null
+++ b/modules/file_storage/file_storage/core/__init__.py
@@ -0,0 +1,6 @@
+"""What every file_storage feature builds on.
+
+Constants, settings, the app.state container, errors, tenant scope, byte
+formatting, health, audit labels, the public-file tenant cache, durable tenant
+teardown, the object reaper and synchronous worker access.
+"""
diff --git a/modules/file_storage/file_storage/audit_labels.py b/modules/file_storage/file_storage/core/audit_labels.py
similarity index 100%
rename from modules/file_storage/file_storage/audit_labels.py
rename to modules/file_storage/file_storage/core/audit_labels.py
diff --git a/modules/file_storage/file_storage/constants.py b/modules/file_storage/file_storage/core/constants.py
similarity index 100%
rename from modules/file_storage/file_storage/constants.py
rename to modules/file_storage/file_storage/core/constants.py
diff --git a/modules/file_storage/file_storage/errors.py b/modules/file_storage/file_storage/core/errors.py
similarity index 88%
rename from modules/file_storage/file_storage/errors.py
rename to modules/file_storage/file_storage/core/errors.py
index cffb70972..3af9df6ba 100644
--- a/modules/file_storage/file_storage/errors.py
+++ b/modules/file_storage/file_storage/core/errors.py
@@ -4,8 +4,8 @@
 from fastapi.responses import JSONResponse
 from simple_module_hosting.i18n_deps import get_translator
 
-from file_storage import constants
-from file_storage.backend_guard import BackendUnavailableError
+from file_storage.backends.guard import BackendUnavailableError
+from file_storage.core import constants
 
 
 async def _backend_unavailable(request: Request, exc: Exception) -> JSONResponse:
diff --git a/modules/file_storage/file_storage/format.py b/modules/file_storage/file_storage/core/format.py
similarity index 100%
rename from modules/file_storage/file_storage/format.py
rename to modules/file_storage/file_storage/core/format.py
diff --git a/modules/file_storage/file_storage/health.py b/modules/file_storage/file_storage/core/health.py
similarity index 100%
rename from modules/file_storage/file_storage/health.py
rename to modules/file_storage/file_storage/core/health.py
diff --git a/modules/file_storage/file_storage/object_reaper.py b/modules/file_storage/file_storage/core/object_reaper.py
similarity index 97%
rename from modules/file_storage/file_storage/object_reaper.py
rename to modules/file_storage/file_storage/core/object_reaper.py
index c5537c04a..2faa7471b 100644
--- a/modules/file_storage/file_storage/object_reaper.py
+++ b/modules/file_storage/file_storage/core/object_reaper.py
@@ -11,7 +11,8 @@
 from sqlalchemy import select
 from sqlmodel import col
 
-from file_storage import constants, thumbnails
+from file_storage.core import constants
+from file_storage.files import thumbnails
 from file_storage.models import StoredFile, UploadSession
 
 logger = logging.getLogger(__name__)
diff --git a/modules/file_storage/file_storage/core/scope.py b/modules/file_storage/file_storage/core/scope.py
new file mode 100644
index 000000000..f6169e538
--- /dev/null
+++ b/modules/file_storage/file_storage/core/scope.py
@@ -0,0 +1,72 @@
+"""Which tenant a stored file belongs to — and the one way to act as the platform.
+
+``StoredFile`` is ``MultiTenantMixin`` (#383): request code reads, writes and
+deletes only the bound tenant's files, and strict mode fails closed with no
+tenant bound. Two callers need something else, and both go through here:
+
+* **Upload** must know the owning tenant *before* the row exists, because the
+  storage key is prefixed with it and the bytes are written to the backend
+  before the row is flushed. :func:`owning_tenant` answers that the same way
+  the flush guard will, so a strict install with no tenant fails before any
+  object is written rather than after.
+* **Platform-owned files** — today, branding's logo and favicon — belong to no
+  tenant and must stay readable from anonymous requests, where no tenant is
+  bound at all. They are stamped :data:`PLATFORM_TENANT_ID` and read under
+  :func:`platform_scope`, restricted to that owner. The id is reserved in
+  ``simple_module_db`` — ``is_valid_tenant_id`` refuses it — so no request,
+  job or tenant can ever be bound to it, and it is distinct from
+  ``DEFAULT_TENANT_ID``, which owns a single-tenant install's ordinary rows.
+"""
+
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+
+from simple_module_db import PLATFORM_TENANT_ID, all_tenants, current_tenant_id
+from simple_module_db.query_filter import fallback_tenant_id, is_strict
+from simple_module_db.tenancy import missing_tenant_error
+from sqlalchemy.ext.asyncio import AsyncSession
+
+
+def owning_tenant(db: AsyncSession, *, platform: bool = False) -> str:
+    """The tenant a new upload is stamped with, decided before the bytes move.
+
+    Bound tenant if there is one; ``PLATFORM_TENANT_ID`` for a platform upload;
+    on a non-strict install with nothing bound, the install's fallback
+    (``default_tenant`` or ``DEFAULT_TENANT_ID``) — the flush guard's own
+    choice. Strict with nothing bound raises ``MissingTenantError``.
+    """
+    if platform:
+        return PLATFORM_TENANT_ID
+    bound = current_tenant_id.get()
+    if bound:
+        return bound
+    if is_strict(db.sync_session):
+        raise missing_tenant_error("StoredFile", "INSERT")
+    return fallback_tenant_id(db.sync_session)
+
+
+@asynccontextmanager
+async def platform_scope(db: AsyncSession, platform: bool) -> AsyncGenerator[None]:
+    """``all_tenants()`` for platform-file access, a no-op otherwise.
+
+    Callers pair it with a ``tenant_id == PLATFORM_TENANT_ID`` condition, so
+    the bypass widens *which context* may read a platform file without letting
+    a platform caller reach any tenant's rows.
+
+    The bypass covers the session's whole flush, not one statement, so it must
+    never carry the caller's unrelated pending writes along: those are flushed
+    first, under the normal guard (stamped with, and checked against, the bound
+    tenant), and autoflush is off inside — only what the block itself adds or
+    changes is flushed with isolation lifted.
+    """
+    if not platform:
+        yield
+        return
+    await db.flush()
+    with db.no_autoflush, all_tenants():
+        yield
+
+
+__all__ = ["PLATFORM_TENANT_ID", "owning_tenant", "platform_scope"]
diff --git a/modules/file_storage/file_storage/services.py b/modules/file_storage/file_storage/core/services.py
similarity index 90%
rename from modules/file_storage/file_storage/services.py
rename to modules/file_storage/file_storage/core/services.py
index b0622b61d..376eb1716 100644
--- a/modules/file_storage/file_storage/services.py
+++ b/modules/file_storage/file_storage/core/services.py
@@ -19,11 +19,11 @@
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING
 
-from file_storage.aggregates import AggregateCache
+from file_storage.files.aggregates import AggregateCache
 
 if TYPE_CHECKING:
     from file_storage.contracts.service import StorageBackend
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
 
 
 @dataclass
diff --git a/modules/file_storage/file_storage/core/settings.py b/modules/file_storage/file_storage/core/settings.py
new file mode 100644
index 000000000..387127ef7
--- /dev/null
+++ b/modules/file_storage/file_storage/core/settings.py
@@ -0,0 +1,187 @@
+"""file_storage module settings (DB-backed).
+
+Construction no longer reads ``SM_FILE_STORAGE_*`` environment variables.
+Values come from pydantic defaults at boot, then get hydrated from the DB
+by the hosting lifespan before module ``on_startup`` runs. Runtime changes
+go through ``settings.module_settings.reload.apply_changes_and_reload``.
+
+Fields are grouped via ``json_schema_extra={"group": ...}`` so the admin UI
+can render them under their respective backend sections.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from pydantic import Field, field_validator, model_validator
+from pydantic_settings import SettingsConfigDict
+from simple_module_core.settings_base import DbBackedSettings
+from simple_module_core.stored_settings import field_error
+
+from file_storage.core import constants
+
+# "s3" is SigV2, kept only for legacy S3-compatible stores that lack SigV4.
+_SIGNATURE_VERSIONS = frozenset({"s3v4", "s3"})
+
+
+class FileStorageSettings(DbBackedSettings):
+    """Configuration for the file_storage module.
+
+    The active backend is selected by ``backend`` (matches a key in the
+    backend registry). All ``s3_*`` fields are optional unless ``backend``
+    selects S3, in which case the validator below enforces presence of
+    bucket + region. Custom backends supply their own validation by
+    subclassing or by reading additional fields at registration time.
+    """
+
+    # ``DbBackedSettings`` (not ``BaseSettings``) so the DB is genuinely the
+    # only source: omitting ``env_prefix`` would leave pydantic-settings
+    # reading each field from its bare name — GH #283.
+    model_config = SettingsConfigDict(extra="ignore")
+
+    backend: str = Field(
+        default=constants.DEFAULT_BACKEND, json_schema_extra={"requires_restart": True}
+    )
+
+    # Filesystem backend
+    fs_root_path: str = Field(
+        default=constants.DEFAULT_FS_ROOT,
+        json_schema_extra={"group": "Filesystem", "requires_restart": True},
+    )
+
+    # S3-compatible backend (works with AWS S3, MinIO, R2, etc.)
+    s3_bucket: str = Field(default="", json_schema_extra={"group": "S3", "requires_restart": True})
+    s3_region: str = Field(default="", json_schema_extra={"group": "S3", "requires_restart": True})
+    s3_access_key_id: str = Field(
+        default="", json_schema_extra={"group": "S3", "requires_restart": True}
+    )
+    s3_secret_access_key: str = Field(
+        default="", json_schema_extra={"group": "S3", "requires_restart": True}
+    )
+    s3_endpoint_url: str = Field(
+        default="",
+        json_schema_extra={"group": "S3", "requires_restart": True},
+        description="Custom endpoint for MinIO / R2. Blank uses AWS default.",
+    )
+    s3_public_endpoint_url: str = Field(
+        default="",
+        json_schema_extra={"group": "S3", "requires_restart": True},
+        description=(
+            "Browser-facing S3 endpoint used to presign direct part uploads, when it "
+            "differs from s3_endpoint_url (e.g. an internal MinIO hostname). Blank "
+            "falls back to s3_endpoint_url. Its origin is added to CSP connect-src."
+        ),
+    )
+    s3_signature_version: str = Field(
+        default="s3v4",
+        json_schema_extra={"group": "S3", "requires_restart": True},
+        description="Presign signature version. Keep s3v4; SigV2 is rejected by most providers.",
+    )
+    s3_presign_ttl_seconds: int = Field(
+        default=constants.DEFAULT_PRESIGN_TTL_SECONDS,
+        json_schema_extra={"group": "S3"},
+    )
+
+    # Limits
+    max_file_size_bytes: int = constants.DEFAULT_MAX_FILE_SIZE_BYTES
+    allowed_content_types: list[str] | None = Field(
+        default=None,
+        description="Whitelist of MIME types. None = any type allowed.",
+    )
+    # Enforced for plain uploads and resumable sessions: stored bytes plus
+    # unexpired active reservations. None leaves aggregate storage unlimited.
+    # Positive, and no larger than a browser can hold exactly: the screen and
+    # the settings editor read it as a JavaScript number (#548).
+    quota_bytes: int | None = Field(
+        default=None,
+        gt=0,
+        le=constants.MAX_JS_SAFE_INTEGER,
+        description=(
+            "Storage ceiling for stored files and active upload reservations. None = unlimited."
+        ),
+    )
+
+    public_files_cors: bool = Field(
+        default=True,
+        description=(
+            "Let any origin read public files cross-origin (no credentials), so a "
+            "page on another site can embed or range-read them. Applies at once."
+        ),
+    )
+
+    # Resumable / direct uploads (#454)
+    direct_upload_threshold_bytes: int = Field(
+        default=constants.DEFAULT_DIRECT_UPLOAD_THRESHOLD_BYTES,
+        gt=0,
+        description="Files larger than this upload in parts through a resumable session.",
+    )
+    max_direct_upload_bytes: int = Field(
+        default=constants.DEFAULT_MAX_DIRECT_UPLOAD_BYTES,
+        gt=0,
+        description="Largest file the resumable session flow accepts.",
+    )
+    multipart_part_size_bytes: int = Field(
+        default=constants.DEFAULT_PART_SIZE_BYTES,
+        ge=constants.MIN_PART_SIZE_BYTES,
+        # S3 refuses parts over 5 GiB; a larger value would fail every multipart put.
+        le=constants.MAX_S3_PART_SIZE_BYTES,
+        description="Preferred part size; grown automatically to stay under 10,000 parts.",
+    )
+    upload_session_ttl_seconds: int = Field(
+        default=constants.DEFAULT_UPLOAD_SESSION_TTL_SECONDS,
+        gt=0,
+        description="How long an unfinished upload session stays resumable.",
+    )
+    upload_session_retention_days: int = Field(
+        default=constants.DEFAULT_UPLOAD_SESSION_RETENTION_DAYS,
+        ge=0,
+        description="How long finished (completed or aborted) upload session rows are kept.",
+    )
+
+    @field_validator("s3_signature_version")
+    @classmethod
+    def _known_signature_version(cls, value: str) -> str:
+        # botocore only fails on an unknown version when the first client is
+        # built, so an admin-UI typo would otherwise surface as failed uploads.
+        if value not in _SIGNATURE_VERSIONS:
+            raise ValueError(f"s3_signature_version must be one of {sorted(_SIGNATURE_VERSIONS)}")
+        return value
+
+    @model_validator(mode="after")
+    def _validate_backend_config(self) -> FileStorageSettings:
+        """Enforce per-backend required fields.
+
+        We validate at config time rather than at backend construction so
+        misconfigured prod boots fail fast with a clear message instead of
+        deferring the error until the first upload.
+        """
+        if self.backend == constants.BackendId.S3:
+            missing = [
+                name
+                for name, value in (
+                    ("s3_bucket", self.s3_bucket),
+                    ("s3_region", self.s3_region),
+                )
+                if not value
+            ]
+            if missing:
+                # Located on the first missing field (declared after ``backend``) so
+                # the form shows it there; ``backend`` is related so lenient boot
+                # can fall back to the default backend instead of failing.
+                raise field_error(
+                    type(self),
+                    missing[0],
+                    "s3_config_incomplete",
+                    f"S3 backend selected but {', '.join(missing)} is not set.",
+                    value=getattr(self, missing[0]),
+                    related=["backend", "s3_bucket", "s3_region"],
+                )
+        return self
+
+    def presign_endpoint_url(self) -> str:
+        """The endpoint browsers reach: ``s3_public_endpoint_url``, else ``s3_endpoint_url``."""
+        return self.s3_public_endpoint_url or self.s3_endpoint_url
+
+    def resolved_fs_root(self) -> Path:
+        """Return ``fs_root_path`` as an absolute Path."""
+        return Path(self.fs_root_path).expanduser().resolve()
diff --git a/modules/file_storage/file_storage/tenant_cache.py b/modules/file_storage/file_storage/core/tenant_cache.py
similarity index 100%
rename from modules/file_storage/file_storage/tenant_cache.py
rename to modules/file_storage/file_storage/core/tenant_cache.py
diff --git a/modules/file_storage/file_storage/core/tenant_deletion.py b/modules/file_storage/file_storage/core/tenant_deletion.py
new file mode 100644
index 000000000..67368aee5
--- /dev/null
+++ b/modules/file_storage/file_storage/core/tenant_deletion.py
@@ -0,0 +1,155 @@
+"""Durable tenant teardown, with backend work following the row-deletion commit."""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from simple_module_core.durable_events import DurableContext
+from simple_module_core.events import Event, EventBus
+from simple_module_core.tenant_events import TenantDeleted
+from simple_module_db import tenant_context
+from sqlmodel import col, delete, select
+
+from file_storage.backends import build_backend
+from file_storage.contracts.service import StorageBackend, StorageNotFoundError
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files.thumbnails import variant_key
+from file_storage.models import StoredFile, UploadSession
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+
+_logger = logging.getLogger(__name__)
+
+CLEANUP_BATCH_SIZE = 500
+
+_PURGE_HANDLER = "file_storage.tenant_deletion.purge_rows"
+_OBJECT_HANDLER = "file_storage.tenant_deletion.purge_objects"
+
+
+@dataclass
+class TenantStorageCleanupRequested(Event):
+    """A persisted cleanup manifest, surviving deletion of the source rows."""
+
+    files: list[tuple[str, str]]
+    uploads: list[tuple[str, str | None]]
+
+
+# Durable wire key stored in outbox rows (derived from ``__module__``): it must keep
+# naming the pre-layout path, so never change it. Set after the class because
+# ``@dataclass`` looks ``cls.__module__`` up in ``sys.modules`` while decorating.
+TenantStorageCleanupRequested.__module__ = "file_storage.tenant_deletion"
+
+
+def register_tenant_deletion(bus: EventBus, app: FastAPI | None) -> None:
+    """Register on both web and worker buses, including workers without an app."""
+
+    async def purge_rows(event: TenantDeleted, ctx: DurableContext) -> None:
+        with tenant_context(event.tenant_id):
+            for model, columns in (
+                (StoredFile, (StoredFile.backend, StoredFile.key)),
+                (
+                    UploadSession,
+                    (UploadSession.key, UploadSession.backend_upload_id, UploadSession.status),
+                ),
+            ):
+                result = await ctx.db.execute(
+                    select(*columns)
+                    .where(col(model.tenant_id) == event.tenant_id)
+                    .execution_options(include_deleted=True)
+                )
+                projected = result.all()
+                for start in range(0, len(projected), CLEANUP_BATCH_SIZE):
+                    rows = projected[start : start + CLEANUP_BATCH_SIZE]
+                    manifest = TenantStorageCleanupRequested(
+                        files=[(row[0], row[1]) for row in rows] if model is StoredFile else [],
+                        uploads=[
+                            (row[0], row[1])
+                            for row in rows
+                            if row[2] == constants.UploadStatus.ACTIVE
+                        ]
+                        if model is UploadSession
+                        else [],
+                    )
+                    if not manifest.files and not manifest.uploads:
+                        continue
+                    on_commit = getattr(ctx.db, "on_commit", None)
+                    if bus.durable_transport is not None:
+                        await bus.publish_durable(manifest, ctx.db)
+                    elif on_commit is not None:
+                        # Bind each chunk so callbacks cannot reuse the last manifest.
+                        on_commit(
+                            lambda manifest=manifest: bus.publish_durable_or_inline(
+                                manifest, ctx.db
+                            )
+                        )
+                    else:
+                        _logger.warning(
+                            "file_storage.tenant_cleanup_deferred tenant=%s objects=%d",
+                            event.tenant_id,
+                            len(manifest.files),
+                        )
+            for model in (UploadSession, StoredFile):
+                await ctx.db.execute(
+                    delete(model)
+                    .where(col(model.tenant_id) == event.tenant_id)
+                    .execution_options(include_deleted=True)
+                )
+
+    async def purge_objects(event: TenantStorageCleanupRequested, ctx: DurableContext) -> None:
+        # Run only after the row transaction commits. With a transport,
+        # failures retain the manifest in the outbox for idempotent retries.
+        settings = _settings(app)
+        backends: dict[str, StorageBackend] = {}
+        failures: list[Exception] = []
+
+        async def attempt(operation) -> None:
+            try:
+                await operation
+            except StorageNotFoundError:
+                pass
+            except Exception as exc:
+                failures.append(exc)
+
+        for backend_id, key in event.files:
+            if backend_id != settings.backend:
+                # Only the active provider is configured; building another from
+                # these settings would raise on every retry and wedge the rest.
+                _logger.warning(
+                    "file_storage.backend_mismatch key=%s stored=%s active=%s — object retained",
+                    key,
+                    backend_id,
+                    settings.backend,
+                )
+                continue
+            backend = backends.get(backend_id)
+            if backend is None:
+                backend = build_backend(settings.model_copy(update={"backend": backend_id}))
+                backends[backend_id] = backend
+            for target in [key, *(variant_key(key, w) for w in constants.THUMBNAIL_WIDTHS)]:
+                await attempt(backend.delete(target))
+        if event.uploads:
+            backend = build_backend(settings)
+            for key, upload_id in event.uploads:
+                if upload_id is None:
+                    continue
+                # Attempt the delete even if abort fails; retry the entire
+                # idempotent manifest on failure, bounded by outbox max attempts.
+                await attempt(backend.abort_multipart(key, upload_id))
+                await attempt(backend.delete(key))
+        if failures:
+            raise ExceptionGroup("Tenant storage cleanup failed", failures)
+
+    bus.subscribe_durable(TenantDeleted, purge_rows, name=_PURGE_HANDLER)
+    bus.subscribe_durable(TenantStorageCleanupRequested, purge_objects, name=_OBJECT_HANDLER)
+
+
+def _settings(app: FastAPI | None) -> FileStorageSettings:
+    if app is not None:
+        return app.state.file_storage.settings
+    from background_tasks import settings_for
+
+    return settings_for(FileStorageSettings, constants.MODULE_NAME)
diff --git a/modules/file_storage/file_storage/worker.py b/modules/file_storage/file_storage/core/worker.py
similarity index 95%
rename from modules/file_storage/file_storage/worker.py
rename to modules/file_storage/file_storage/core/worker.py
index e04de0882..9d37d99d0 100644
--- a/modules/file_storage/file_storage/worker.py
+++ b/modules/file_storage/file_storage/core/worker.py
@@ -23,13 +23,13 @@
 from simple_module_db.callbacks import register_on_commit
 from starlette.datastructures import Headers
 
-from file_storage.backend_guard import require_backend
+from file_storage.backends.guard import require_backend
 from file_storage.contracts import FileUploaded, NotSupportedError, StoredFileOut
-from file_storage.downloads import presigned_download_url
+from file_storage.core.scope import owning_tenant
+from file_storage.core.worker_support import backend_and_settings
+from file_storage.files.downloads import presigned_download_url
+from file_storage.files.service import FileStorageService
 from file_storage.models import StoredFile
-from file_storage.scope import owning_tenant
-from file_storage.service import FileStorageService
-from file_storage.worker_support import backend_and_settings
 
 logger = logging.getLogger(__name__)
 
diff --git a/modules/file_storage/file_storage/worker_support.py b/modules/file_storage/file_storage/core/worker_support.py
similarity index 81%
rename from modules/file_storage/file_storage/worker_support.py
rename to modules/file_storage/file_storage/core/worker_support.py
index e8b6b4577..f382ab57e 100644
--- a/modules/file_storage/file_storage/worker_support.py
+++ b/modules/file_storage/file_storage/core/worker_support.py
@@ -1,9 +1,9 @@
 """Hydrated backend construction shared by sync worker APIs and tasks."""
 
-from file_storage import constants
 from file_storage.backends import build_backend
 from file_storage.contracts.service import StorageBackend
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 
 
 def backend_and_settings() -> tuple[StorageBackend, FileStorageSettings]:
diff --git a/modules/file_storage/file_storage/deps.py b/modules/file_storage/file_storage/deps.py
index 05c542a51..e890d2dd0 100644
--- a/modules/file_storage/file_storage/deps.py
+++ b/modules/file_storage/file_storage/deps.py
@@ -1,58 +1,11 @@
-"""FastAPI dependencies for the file_storage module."""
+"""Moved to :mod:`file_storage.web.deps`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-from fastapi import Depends, Request
-from simple_module_core.events import EventBus
-from simple_module_core.permissions import grants
-from simple_module_db.deps import get_db
-from simple_module_db.listeners import current_user_id
-from simple_module_hosting.permissions import ensure_resolved_permissions
-from sqlalchemy.ext.asyncio import AsyncSession
+import importlib
+import sys
 
-from file_storage import constants
-from file_storage.service import FileStorageService
-from file_storage.services import FileStorageServices
+from simple_module_core.deprecation import deprecated_module
 
-# Matches no row: ``created_by`` is a user id or NULL, never the empty string.
-NO_OWNER = ""
-
-
-async def get_file_storage_services(request: Request) -> FileStorageServices:
-    return request.app.state.file_storage
-
-
-async def get_file_storage_service(
-    db: AsyncSession = Depends(get_db),
-    services: FileStorageServices = Depends(get_file_storage_services),
-) -> FileStorageService:
-    if services.backend is None:
-        raise RuntimeError("file_storage backend is not initialised (on_startup has not run)")
-    return FileStorageService(db, services.backend, services.settings, services.aggregates)
-
-
-async def get_owner_scope(request: Request) -> str | None:
-    """Whose files this request may see and change (#544).
-
-    ``None`` — every file in the active tenant — for a caller holding
-    ``file_storage.manage`` (platform admins via the wildcard, organisation
-    admins and owners). Anyone else is confined to the rows they uploaded: the
-    id is read from the same ``current_user_id`` the audit listener stamps
-    ``created_by`` with, so the two cannot disagree. A principal with no id
-    gets :data:`NO_OWNER`, which matches nothing rather than everything.
-
-    Endpoints hand the result to the service, which applies it in the query —
-    so another user's file misses exactly like an unknown id (404, not 403).
-    Internal callers (branding, reapers, tasks) never pass it and stay
-    unscoped.
-    """
-    if grants(await ensure_resolved_permissions(request), constants.Permission.MANAGE):
-        return None
-    return current_user_id.get() or NO_OWNER
-
-
-OwnerScope = Depends(get_owner_scope)
-
-
-async def get_event_bus(request: Request) -> EventBus:
-    return request.app.state.sm.event_bus
+deprecated_module("file_storage.deps", remove_in="0.0.46", use="file_storage.web.deps")
+sys.modules[__name__] = importlib.import_module("file_storage.web.deps")
diff --git a/modules/file_storage/file_storage/downloads.py b/modules/file_storage/file_storage/downloads.py
index 152116952..681b6ac27 100644
--- a/modules/file_storage/file_storage/downloads.py
+++ b/modules/file_storage/file_storage/downloads.py
@@ -1,63 +1,11 @@
-"""How a stored file leaves the app: result shapes and download headers.
-
-``Content-Disposition`` (RFC 6266 / 5987) lives here so the service (presigned
-redirects) and the serving helpers (streamed bodies) build it the same way
-without importing each other.
-"""
+"""Moved to :mod:`file_storage.files.downloads`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-from collections.abc import AsyncIterator
-from dataclasses import dataclass
-from typing import TYPE_CHECKING
-from urllib.parse import quote
-
-from file_storage.backend_guard import require_backend
-
-if TYPE_CHECKING:
-    from file_storage.contracts.service import StorageBackend
-    from file_storage.models import StoredFile
-
-
-@dataclass
-class StreamDownload:
-    """Response shape for backends that proxy bytes through the app."""
-
-    file: StoredFile
-    body: AsyncIterator[bytes] | None  # None when the caller opted out via open_body=False
-
-
-@dataclass
-class RedirectDownload:
-    """Response shape for backends that issue presigned URLs."""
-
-    file: StoredFile
-    url: str
-
-
-Download = StreamDownload | RedirectDownload
-
-
-def content_disposition(filename: str, *, attachment: bool) -> str:
-    ascii_name = "".join(
-        c for c in filename.encode("ascii", "ignore").decode() if c.isprintable() and c not in '"\\'
-    )
-    kind = "attachment" if attachment else "inline"
-    return f"{kind}; filename=\"{ascii_name or 'file'}\"; filename*=UTF-8''{quote(filename)}"
-
+import importlib
+import sys
 
-async def presigned_download_url(
-    backend: StorageBackend, row: StoredFile, ttl_seconds: int, *, attachment: bool
-) -> str:
-    """A presigned URL whose response carries ``row``'s own name and type.
+from simple_module_core.deprecation import deprecated_module
 
-    Without the overrides the backend answers with the object's stored
-    metadata, and the browser saves the file under its opaque key (GH #489).
-    """
-    require_backend(backend, row)
-    return await backend.presigned_get_url(
-        row.key,
-        ttl_seconds,
-        content_disposition=content_disposition(row.filename, attachment=attachment),
-        content_type=row.content_type,
-    )
+deprecated_module("file_storage.downloads", remove_in="0.0.46", use="file_storage.files.downloads")
+sys.modules[__name__] = importlib.import_module("file_storage.files.downloads")
diff --git a/modules/file_storage/file_storage/files/__init__.py b/modules/file_storage/file_storage/files/__init__.py
new file mode 100644
index 000000000..d5d4af55d
--- /dev/null
+++ b/modules/file_storage/file_storage/files/__init__.py
@@ -0,0 +1,5 @@
+"""Stored files.
+
+The service with its reads, deletes and visibility halves, queries and browse
+aggregates, uploader names, media types, downloads, ranges and thumbnails.
+"""
diff --git a/modules/file_storage/file_storage/aggregates.py b/modules/file_storage/file_storage/files/aggregates.py
similarity index 100%
rename from modules/file_storage/file_storage/aggregates.py
rename to modules/file_storage/file_storage/files/aggregates.py
diff --git a/modules/file_storage/file_storage/deletes.py b/modules/file_storage/file_storage/files/deletes.py
similarity index 95%
rename from modules/file_storage/file_storage/deletes.py
rename to modules/file_storage/file_storage/files/deletes.py
index 4e737216f..81d20b89a 100644
--- a/modules/file_storage/file_storage/deletes.py
+++ b/modules/file_storage/file_storage/files/deletes.py
@@ -1,4 +1,4 @@
-"""Delete operations of :class:`~file_storage.service.FileStorageService`.
+"""Delete operations of :class:`~file_storage.files.service.FileStorageService`.
 
 Mixed into the service so ``service.py`` stays about upload/download.
 """
@@ -15,11 +15,11 @@
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from file_storage import queries, thumbnails
-from file_storage.backend_guard import backend_mismatch
+from file_storage.backends.guard import backend_mismatch
 from file_storage.contracts.service import StorageNotFoundError
+from file_storage.core.scope import platform_scope
+from file_storage.files import queries, thumbnails
 from file_storage.models import StoredFile
-from file_storage.scope import platform_scope
 
 if TYPE_CHECKING:
     from file_storage.contracts.service import StorageBackend
diff --git a/modules/file_storage/file_storage/files/downloads.py b/modules/file_storage/file_storage/files/downloads.py
new file mode 100644
index 000000000..be0b9fc9f
--- /dev/null
+++ b/modules/file_storage/file_storage/files/downloads.py
@@ -0,0 +1,63 @@
+"""How a stored file leaves the app: result shapes and download headers.
+
+``Content-Disposition`` (RFC 6266 / 5987) lives here so the service (presigned
+redirects) and the serving helpers (streamed bodies) build it the same way
+without importing each other.
+"""
+
+from __future__ import annotations
+
+from collections.abc import AsyncIterator
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+from urllib.parse import quote
+
+from file_storage.backends.guard import require_backend
+
+if TYPE_CHECKING:
+    from file_storage.contracts.service import StorageBackend
+    from file_storage.models import StoredFile
+
+
+@dataclass
+class StreamDownload:
+    """Response shape for backends that proxy bytes through the app."""
+
+    file: StoredFile
+    body: AsyncIterator[bytes] | None  # None when the caller opted out via open_body=False
+
+
+@dataclass
+class RedirectDownload:
+    """Response shape for backends that issue presigned URLs."""
+
+    file: StoredFile
+    url: str
+
+
+Download = StreamDownload | RedirectDownload
+
+
+def content_disposition(filename: str, *, attachment: bool) -> str:
+    ascii_name = "".join(
+        c for c in filename.encode("ascii", "ignore").decode() if c.isprintable() and c not in '"\\'
+    )
+    kind = "attachment" if attachment else "inline"
+    return f"{kind}; filename=\"{ascii_name or 'file'}\"; filename*=UTF-8''{quote(filename)}"
+
+
+async def presigned_download_url(
+    backend: StorageBackend, row: StoredFile, ttl_seconds: int, *, attachment: bool
+) -> str:
+    """A presigned URL whose response carries ``row``'s own name and type.
+
+    Without the overrides the backend answers with the object's stored
+    metadata, and the browser saves the file under its opaque key (GH #489).
+    """
+    require_backend(backend, row)
+    return await backend.presigned_get_url(
+        row.key,
+        ttl_seconds,
+        content_disposition=content_disposition(row.filename, attachment=attachment),
+        content_type=row.content_type,
+    )
diff --git a/modules/file_storage/file_storage/media_types.py b/modules/file_storage/file_storage/files/media_types.py
similarity index 92%
rename from modules/file_storage/file_storage/media_types.py
rename to modules/file_storage/file_storage/files/media_types.py
index f15447218..60b56151d 100644
--- a/modules/file_storage/file_storage/media_types.py
+++ b/modules/file_storage/file_storage/files/media_types.py
@@ -16,8 +16,8 @@
 
 import re
 
-from file_storage import constants
-from file_storage.thumbnails import base_type
+from file_storage.core import constants
+from file_storage.files.thumbnails import base_type
 
 # RFC 9110 ``token`` characters, on both sides of a single "/".
 _MEDIA_TYPE = re.compile(r"[a-z0-9!#$%&'*+.^_`|~-]+/[a-z0-9!#$%&'*+.^_`|~-]+")
@@ -42,7 +42,7 @@ def normalise_media_type(content_type: str | None) -> str | None:
 def is_active_content(content_type: str | None) -> bool:
     """Whether the type must be served as a sandboxed attachment, never inline.
 
-    True for everything outside :data:`~file_storage.constants.INLINE_SAFE_CONTENT_TYPES`
+    True for everything outside :data:`~file_storage.core.constants.INLINE_SAFE_CONTENT_TYPES`
     and the media families, for any XML subtype even inside those families,
     and for any value :func:`normalise_media_type` cannot read.
     """
diff --git a/modules/file_storage/file_storage/queries.py b/modules/file_storage/file_storage/files/queries.py
similarity index 97%
rename from modules/file_storage/file_storage/queries.py
rename to modules/file_storage/file_storage/files/queries.py
index c522661fc..61b0d42f0 100644
--- a/modules/file_storage/file_storage/queries.py
+++ b/modules/file_storage/file_storage/files/queries.py
@@ -7,7 +7,7 @@
 
 Everything here is scoped by the caller's filters. The *unfiltered* bucket
 totals — the byte usage and both facet lists, which describe the bucket rather
-than the page — live in :mod:`file_storage.aggregates`, where one grouped scan
+than the page — live in :mod:`file_storage.files.aggregates`, where one grouped scan
 answers all three and the result can be cached.
 """
 
@@ -20,8 +20,8 @@
 from sqlalchemy import Select, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from file_storage import constants
 from file_storage.contracts.schemas import StoredFileOut
+from file_storage.core import constants
 from file_storage.models import StoredFile
 
 
@@ -151,7 +151,7 @@ async def content_type_facets(db: AsyncSession, *, created_by: str | None = None
     Offering the full IANA list would be noise; the only types worth showing
     are the ones actually in the bucket. The unfiltered case — what the browse
     dropdown actually renders — is answered from
-    :func:`file_storage.aggregates.compute` instead, which gets it out of the
+    :func:`file_storage.files.aggregates.compute` instead, which gets it out of the
     same scan as the uploader facets and the byte total.
     """
     query = select(StoredFile.content_type, func.count().label("n"))
diff --git a/modules/file_storage/file_storage/ranges.py b/modules/file_storage/file_storage/files/ranges.py
similarity index 98%
rename from modules/file_storage/file_storage/ranges.py
rename to modules/file_storage/file_storage/files/ranges.py
index 5b844053d..cf00508f3 100644
--- a/modules/file_storage/file_storage/ranges.py
+++ b/modules/file_storage/file_storage/files/ranges.py
@@ -17,7 +17,7 @@
 from fastapi import Request, Response, status
 from fastapi.responses import StreamingResponse
 
-from file_storage.backend_guard import require_backend
+from file_storage.backends.guard import require_backend
 from file_storage.contracts.service import StorageBackend
 from file_storage.models import StoredFile
 
diff --git a/modules/file_storage/file_storage/reads.py b/modules/file_storage/file_storage/files/reads.py
similarity index 89%
rename from modules/file_storage/file_storage/reads.py
rename to modules/file_storage/file_storage/files/reads.py
index 8e78a641a..1111486ce 100644
--- a/modules/file_storage/file_storage/reads.py
+++ b/modules/file_storage/file_storage/files/reads.py
@@ -1,4 +1,4 @@
-"""The read half of :class:`~file_storage.service.FileStorageService`.
+"""The read half of :class:`~file_storage.files.service.FileStorageService`.
 
 Mixed into the service rather than living beside upload/download/delete because
 it is a different job with different costs: nothing here touches a storage
@@ -6,8 +6,8 @@
 database work one screen pays for. Keeping it separate is what makes that
 question answerable by reading one short file.
 
-The SQL itself is in :mod:`file_storage.queries` (filtered reads) and
-:mod:`file_storage.aggregates` (unfiltered bucket totals); these methods are
+The SQL itself is in :mod:`file_storage.files.queries` (filtered reads) and
+:mod:`file_storage.files.aggregates` (unfiltered bucket totals); these methods are
 the seam callers already use.
 """
 
@@ -17,11 +17,12 @@
 
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from file_storage import aggregates, constants, queries
 from file_storage.contracts.schemas import StoredFileOut
+from file_storage.core import constants
+from file_storage.files import aggregates, queries
 
 if TYPE_CHECKING:
-    from file_storage.aggregates import AggregateCache, StorageAggregates
+    from file_storage.files.aggregates import AggregateCache, StorageAggregates
 
 
 class FileStorageReads:
diff --git a/modules/file_storage/file_storage/resolve.py b/modules/file_storage/file_storage/files/resolve.py
similarity index 96%
rename from modules/file_storage/file_storage/resolve.py
rename to modules/file_storage/file_storage/files/resolve.py
index b3379ad6e..972accb60 100644
--- a/modules/file_storage/file_storage/resolve.py
+++ b/modules/file_storage/file_storage/files/resolve.py
@@ -14,7 +14,7 @@
 
 from simple_module_core.user_directory import resolve_user_labels as resolve_uploader_labels
 
-from file_storage import constants
+from file_storage.core import constants
 
 
 def label_for(user_id: str | None, labels: dict[str, str]) -> str:
diff --git a/modules/file_storage/file_storage/files/service.py b/modules/file_storage/file_storage/files/service.py
new file mode 100644
index 000000000..3d444c87d
--- /dev/null
+++ b/modules/file_storage/file_storage/files/service.py
@@ -0,0 +1,217 @@
+"""file_storage service — upload, download, delete orchestration.
+
+The read side (listing, paging, bucket totals) is mixed in from
+:mod:`file_storage.files.reads`, so this file stays about the half of the job
+that talks to a storage backend and mutates rows.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import uuid
+from collections.abc import AsyncIterator
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from fastapi import UploadFile
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import col
+
+from file_storage.backends.guard import require_backend
+from file_storage.contracts.schemas import StoredFileOut
+from file_storage.core import constants
+from file_storage.core.scope import PLATFORM_TENANT_ID, owning_tenant, platform_scope
+from file_storage.files import queries
+from file_storage.files.deletes import FileStorageDeletes
+from file_storage.files.downloads import (
+    Download,
+    RedirectDownload,
+    StreamDownload,
+    presigned_download_url,
+)
+from file_storage.files.reads import FileStorageReads
+from file_storage.files.visibility import FileStoragePublic
+from file_storage.models import StoredFile
+from file_storage.multipart.guards import StorageQuota
+
+if TYPE_CHECKING:
+    from file_storage.contracts.service import StorageBackend
+    from file_storage.core.settings import FileStorageSettings
+    from file_storage.files.aggregates import AggregateCache
+
+
+_logger = logging.getLogger(__name__)
+
+
+class FileTooLargeError(Exception):
+    """Raised when an upload exceeds the configured size limit."""
+
+
+class ContentTypeNotAllowedError(Exception):
+    """Raised when the upload's content type isn't in the allow-list."""
+
+
+class StoredFileNotFoundError(Exception):
+    """Raised when a StoredFile lookup misses; endpoints map this to HTTP 404."""
+
+
+class FileStorageService(FileStoragePublic, FileStorageReads, FileStorageDeletes, StorageQuota):
+    """Orchestrates validation, hashing, backend IO, and DB lifecycle."""
+
+    def __init__(
+        self,
+        db: AsyncSession,
+        backend: StorageBackend,
+        settings: FileStorageSettings,
+        aggregate_cache: AggregateCache | None = None,
+    ) -> None:
+        self.db = db
+        self.backend = backend
+        self.settings = settings
+        # Optional on purpose. The app-wide cache lives on ``app.state`` and is
+        # handed in by ``deps``; a service built directly — a test, a script —
+        # gets ``None`` and reads the database every time, which is what a
+        # caller checking "did my write land?" wants and what keeps a
+        # short-lived instance from serving numbers nobody invalidates.
+        self._aggregate_cache = aggregate_cache
+
+    # ── Upload ───────────────────────────────────────────────────────
+
+    async def upload(
+        self, upload: UploadFile, *, platform: bool = False, public: bool = False
+    ) -> StoredFileOut:
+        """Validate, stream-hash, persist to backend, and record metadata.
+
+        The row belongs to the bound tenant, or — with ``platform=True`` — to
+        no tenant (:data:`~file_storage.core.scope.PLATFORM_TENANT_ID`), for files
+        the whole install serves, such as branding images. The owner is
+        settled first: the key is prefixed with it, and a strict install with
+        no tenant must fail before an object is written, not after.
+        """
+        content_type = upload.content_type or "application/octet-stream"
+        self._check_content_type(content_type)
+        tenant_id = owning_tenant(self.db, platform=platform)
+
+        size = 0
+        sha = hashlib.sha256()
+        max_size = self.settings.max_file_size_bytes
+
+        async def _hashing_stream() -> AsyncIterator[bytes]:
+            nonlocal size
+            while True:
+                chunk = await upload.read(constants.DEFAULT_CHUNK_SIZE)
+                if not chunk:
+                    break
+                size += len(chunk)
+                if size > max_size:
+                    raise FileTooLargeError(f"Upload exceeds {max_size} bytes.")
+                sha.update(chunk)
+                yield chunk
+
+        key = generate_key(tenant_id, upload.filename or "file")
+        await self.backend.put(
+            key,
+            _hashing_stream(),
+            content_type=content_type,
+            # 0 means unknown: the backend spools, or streams multipart parts.
+            size=upload.size or 0,
+        )
+
+        # Compensation: on DB failure, drop the just-uploaded object. A
+        # cleanup-time exception must NOT replace the original failure —
+        # otherwise the operator chases the wrong root cause. We swallow
+        # the cleanup error after logging; the orphaned key can be reaped
+        # by a janitor sweep.
+        try:
+            await self._check_quota(size, reserve=True, platform=platform)
+            row = StoredFile(
+                tenant_id=tenant_id,
+                key=key,
+                filename=upload.filename or key,
+                content_type=content_type,
+                size_bytes=size,
+                backend=self.backend.backend_id,
+                checksum_sha256=sha.hexdigest(),
+                public=public,
+            )
+            async with platform_scope(self.db, platform):
+                self.db.add(row)
+                await self.db.flush()
+                await self.db.refresh(row)
+        except BaseException:
+            try:
+                await self.backend.delete(key)
+            except BaseException:
+                _logger.exception(
+                    "file_storage.cleanup_failed key=%s — original upload error follows",
+                    key,
+                )
+            raise
+
+        return StoredFileOut.model_validate(queries.to_out_dict(row))
+
+    def _check_content_type(self, content_type: str) -> None:
+        allowed = self.settings.allowed_content_types
+        if allowed is not None and content_type not in allowed:
+            raise ContentTypeNotAllowedError(f"Content-Type {content_type!r} not in allow-list.")
+
+    async def get(
+        self, file_id: uuid.UUID, *, platform: bool = False, owner: str | None = None
+    ) -> StoredFile:
+        """The bound tenant's file, or with ``platform=True`` a platform file.
+
+        Another tenant's id misses exactly like an unknown one. ``platform``
+        needs no tenant bound (anonymous branding requests have none) and only
+        ever matches a platform-owned row, so a tenant's file id handed to a
+        platform caller — say, pasted into a branding setting — still misses.
+        ``owner`` (``deps.get_owner_scope``) narrows it to one uploader's rows
+        the same way: someone else's file misses like an unknown id (#544).
+        """
+        stmt = queries.owned_by(select(StoredFile).where(col(StoredFile.id) == file_id), owner)
+        if platform:
+            stmt = stmt.where(StoredFile.tenant_id == PLATFORM_TENANT_ID)
+        async with platform_scope(self.db, platform):
+            row = (await self.db.execute(stmt)).scalar_one_or_none()
+        if row is None:
+            raise StoredFileNotFoundError(str(file_id))
+        return row
+
+    async def download(
+        self,
+        file_id: uuid.UUID,
+        *,
+        platform: bool = False,
+        open_body: bool = True,
+        owner: str | None = None,
+    ) -> Download:
+        """Return either a streamed body or a redirect URL.
+
+        Dispatch on ``backend.supports_presigned_url`` so the service stays
+        provider-agnostic — adding a new backend that supports presigning
+        works without touching this method.
+        """
+        row = await self.get(file_id, platform=platform, owner=owner)
+        require_backend(self.backend, row)
+        if self.backend.supports_presigned_url:
+            url = await presigned_download_url(
+                self.backend, row, self.settings.s3_presign_ttl_seconds, attachment=True
+            )
+            return RedirectDownload(file=row, url=url)
+        body = await self.backend.get(row.key) if open_body else None
+        return StreamDownload(file=row, body=body)
+
+
+def generate_key(tenant_id: str, filename: str) -> str:
+    """Build a tenant-prefixed, date-sharded, collision-proof key.
+
+    The ``{tenant_id}/`` prefix keeps each tenant's objects in a disjoint
+    namespace on the backend (one prefix to export, purge or bill per tenant).
+    Tenant ids are validated to ``TENANT_ID_PATTERN``, which has no ``/`` and
+    cannot be ``..``, so the prefix is always exactly one path segment.
+    """
+    today = datetime.now(UTC)
+    suffix = Path(filename).suffix
+    return f"{tenant_id}/{today:%Y/%m/%d}/{uuid.uuid4().hex}{suffix}"
diff --git a/modules/file_storage/file_storage/thumbnails.py b/modules/file_storage/file_storage/files/thumbnails.py
similarity index 98%
rename from modules/file_storage/file_storage/thumbnails.py
rename to modules/file_storage/file_storage/files/thumbnails.py
index 05deb45d6..c571e8efe 100644
--- a/modules/file_storage/file_storage/thumbnails.py
+++ b/modules/file_storage/file_storage/files/thumbnails.py
@@ -4,7 +4,7 @@
 key derived from the original's (``{key}.w{width}.webp``). That is the simplest
 cache that is also robust: it survives restarts and is shared by every worker,
 it needs no eviction policy of its own because the width is snapped to a short
-whitelist (:data:`~file_storage.constants.THUMBNAIL_WIDTHS`, so at most five
+whitelist (:data:`~file_storage.core.constants.THUMBNAIL_WIDTHS`, so at most five
 variants per file), it inherits the original's tenant prefix, and it is dropped
 with the original (:func:`delete_variants`). The cost is one extra object per
 size actually requested.
@@ -24,8 +24,8 @@
 
 from PIL import Image, ImageOps
 
-from file_storage import constants
 from file_storage.contracts.service import StorageNotFoundError
+from file_storage.core import constants
 
 if TYPE_CHECKING:
     from file_storage.contracts.service import StorageBackend
diff --git a/modules/file_storage/file_storage/visibility.py b/modules/file_storage/file_storage/files/visibility.py
similarity index 92%
rename from modules/file_storage/file_storage/visibility.py
rename to modules/file_storage/file_storage/files/visibility.py
index 42dd93219..48595547d 100644
--- a/modules/file_storage/file_storage/visibility.py
+++ b/modules/file_storage/file_storage/files/visibility.py
@@ -1,4 +1,4 @@
-"""Public-file and thumbnail operations of :class:`~file_storage.service.FileStorageService`.
+"""Public-file and thumbnail operations of :class:`~file_storage.files.service.FileStorageService`.
 
 Mixed into the service so ``service.py`` stays about upload/download/delete.
 """
@@ -14,13 +14,13 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlmodel import col
 
-from file_storage import thumbnails
-from file_storage.backend_guard import require_backend
+from file_storage.backends.guard import require_backend
+from file_storage.files import thumbnails
 from file_storage.models import StoredFile
 
 if TYPE_CHECKING:
     from file_storage.contracts.service import StorageBackend
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
 
 
 class FileStoragePublic:
@@ -53,7 +53,8 @@ async def get_public(self, file_id: uuid.UUID) -> StoredFile:
         )
         row = (await self.db.execute(stmt)).scalar_one_or_none()
         if row is None:
-            from file_storage.service import StoredFileNotFoundError  # circular at import time
+            # circular at import time
+            from file_storage.files.service import StoredFileNotFoundError
 
             raise StoredFileNotFoundError(str(file_id))
         return row
diff --git a/modules/file_storage/file_storage/models.py b/modules/file_storage/file_storage/models.py
index 23a7aaa0f..bdff62fa8 100644
--- a/modules/file_storage/file_storage/models.py
+++ b/modules/file_storage/file_storage/models.py
@@ -12,7 +12,7 @@
 from sqlalchemy import Index
 from sqlmodel import Field
 
-from file_storage import constants
+from file_storage.core import constants
 
 Base = create_module_base(constants.MODULE_NAME)
 
diff --git a/modules/file_storage/file_storage/module.py b/modules/file_storage/file_storage/module.py
index 67e22c72d..6fbf6a09a 100644
--- a/modules/file_storage/file_storage/module.py
+++ b/modules/file_storage/file_storage/module.py
@@ -22,9 +22,9 @@
 from simple_module_core.public_routes import PublicRouteRegistry
 from simple_module_core.tenancy import TenantRole, tenant_role
 
-from file_storage import constants
-from file_storage.audit_labels import _resolve_file_labels
-from file_storage.body_limits import register_upload_body_limits
+from file_storage.core import constants
+from file_storage.core.audit_labels import _resolve_file_labels
+from file_storage.web.body_limits import register_upload_body_limits
 
 if TYPE_CHECKING:
     from fastapi import FastAPI
@@ -45,8 +45,8 @@ class FileStorageModule(ModuleBase):
     )
 
     def register_settings(self, app: FastAPI) -> None:
-        from file_storage.services import FileStorageServices
-        from file_storage.settings import FileStorageSettings
+        from file_storage.core.services import FileStorageServices
+        from file_storage.core.settings import FileStorageSettings
 
         # The CORS toggle is evaluated per request and the hook gets no ``app``.
         self._app = app
@@ -58,25 +58,25 @@ def register_settings(self, app: FastAPI) -> None:
         )
 
     def register_event_handlers(self, bus: EventBus, app: FastAPI | None = None) -> None:
-        from file_storage.tenant_deletion import register_tenant_deletion
+        from file_storage.core.tenant_deletion import register_tenant_deletion
 
         register_tenant_deletion(bus, app)
 
     def register_invalidations(self, bus: InvalidationBus, app: FastAPI) -> None:
-        from file_storage.tenant_cache import register_tenant_cache
+        from file_storage.core.tenant_cache import register_tenant_cache
 
         register_tenant_cache(bus, app)
 
     def register_exception_handlers(self, app: FastAPI) -> None:
-        from file_storage.errors import install_exception_handlers
+        from file_storage.core.errors import install_exception_handlers
 
         install_exception_handlers(app)
 
     def register_routes(self, api_router: APIRouter, view_router: APIRouter) -> None:
-        from file_storage.endpoints.api import router as api
-        from file_storage.endpoints.public import router as public
-        from file_storage.endpoints.uploads import router as uploads
-        from file_storage.endpoints.views import router as views
+        from file_storage.web.endpoints.api import router as api
+        from file_storage.web.endpoints.public import router as public
+        from file_storage.web.endpoints.uploads import router as uploads
+        from file_storage.web.endpoints.views import router as views
 
         api_router.include_router(api)
         api_router.include_router(uploads)
@@ -90,8 +90,8 @@ def register_public_routes(self, registry: PublicRouteRegistry) -> None:
         uploads, deletes and the authenticated download keep requiring a
         session. The handler itself still refuses anything not ``public``.
         """
-        from file_storage.constants import PUBLIC_FILES_RATE
-        from file_storage.cookieless import PUBLIC_PATH_PATTERN
+        from file_storage.core.constants import PUBLIC_FILES_RATE
+        from file_storage.web.cookieless import PUBLIC_PATH_PATTERN
 
         # Its own, wider bucket: one public page can embed dozens of images and
         # thumbnails, which would exhaust the shared anonymous default.
@@ -99,13 +99,13 @@ def register_public_routes(self, registry: PublicRouteRegistry) -> None:
 
     def register_cors_policies(self, registry: CorsPolicyRegistry) -> None:
         """Let any origin read public files, without credentials (#527)."""
-        from file_storage.cors import register_public_files_cors
+        from file_storage.web.cors import register_public_files_cors
 
         register_public_files_cors(registry, lambda: getattr(self, "_app", None))
 
     def register_middleware(self, app: FastAPI) -> None:
         """Serve public files without a session cookie or ``Vary: Cookie``."""
-        from file_storage.cookieless import CookielessPublicFilesMiddleware
+        from file_storage.web.cookieless import CookielessPublicFilesMiddleware
 
         app.add_middleware(CookielessPublicFilesMiddleware)
 
@@ -176,7 +176,7 @@ def register_body_limits(self, registry: BodyLimitRegistry) -> None:
 
     def register_csp_sources(self, registry: CspSourceRegistry) -> None:
         """Let the browser PUT multipart parts straight to the S3 endpoint."""
-        from file_storage.csp import connect_src_provider
+        from file_storage.web.csp import connect_src_provider
 
         registry.add_provider(connect_src_provider)
 
@@ -202,8 +202,8 @@ async def on_startup(self, app: FastAPI) -> None:
         picked up — constructing in ``register_settings`` would bake in
         the pydantic defaults instead of the DB overrides.
         """
-        from file_storage.aggregates import register_invalidation
         from file_storage.backends import build_backend
+        from file_storage.files.aggregates import register_invalidation
 
         # With multi_tenant off the install is the only tenant, so ordinary
         # users keep deleting their files. With it on every tenant member also
@@ -238,7 +238,7 @@ async def on_startup(self, app: FastAPI) -> None:
         # settings changes rather than pinning the boot-time instance.
         from simple_module_core.health import HealthCheck
 
-        from file_storage.health import CHECK_BACKEND, build_backend_check
+        from file_storage.core.health import CHECK_BACKEND, build_backend_check
 
         app.state.sm.health_registry.add(
             HealthCheck(
diff --git a/modules/file_storage/file_storage/multipart/__init__.py b/modules/file_storage/file_storage/multipart/__init__.py
new file mode 100644
index 000000000..94b33b9d6
--- /dev/null
+++ b/modules/file_storage/file_storage/multipart/__init__.py
@@ -0,0 +1,4 @@
+"""Resumable multipart uploads.
+
+Sessions, quota guards, part arithmetic and after-the-fact checksums.
+"""
diff --git a/modules/file_storage/file_storage/checksum.py b/modules/file_storage/file_storage/multipart/checksum.py
similarity index 98%
rename from modules/file_storage/file_storage/checksum.py
rename to modules/file_storage/file_storage/multipart/checksum.py
index 9a490b791..355a25914 100644
--- a/modules/file_storage/file_storage/checksum.py
+++ b/modules/file_storage/file_storage/multipart/checksum.py
@@ -14,7 +14,7 @@
 from collections.abc import Callable
 from typing import TYPE_CHECKING, Any
 
-from file_storage import constants
+from file_storage.core import constants
 
 if TYPE_CHECKING:
     from fastapi import FastAPI
diff --git a/modules/file_storage/file_storage/upload_guards.py b/modules/file_storage/file_storage/multipart/guards.py
similarity index 93%
rename from modules/file_storage/file_storage/upload_guards.py
rename to modules/file_storage/file_storage/multipart/guards.py
index c0864b67d..73d52dad5 100644
--- a/modules/file_storage/file_storage/upload_guards.py
+++ b/modules/file_storage/file_storage/multipart/guards.py
@@ -11,11 +11,11 @@
 from sqlalchemy import delete, func, select, text
 from sqlmodel import col
 
-from file_storage import constants
 from file_storage.contracts.service import StorageError
+from file_storage.core import constants
+from file_storage.core.scope import PLATFORM_TENANT_ID, owning_tenant, platform_scope
 from file_storage.models import StoredFile, UploadSession
-from file_storage.scope import PLATFORM_TENANT_ID, owning_tenant, platform_scope
-from file_storage.upload_support import (
+from file_storage.multipart.support import (
     DirectUploadUnsupportedError,
     QuotaExceededError,
     StorageBusyError,
@@ -25,8 +25,8 @@
     from sqlalchemy.ext.asyncio import AsyncSession
 
     from file_storage.contracts.service import DirectUploadBackend
-    from file_storage.service import FileStorageService
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
+    from file_storage.files.service import FileStorageService
 
 _logger = logging.getLogger(__name__)
 
@@ -92,7 +92,7 @@ async def _check_quota(self, size: int, *, reserve: bool, platform: bool = False
 
 
 class UploadGuards(StorageQuota):
-    """Mixed into :class:`~file_storage.uploads.UploadSessionService`."""
+    """Mixed into :class:`~file_storage.multipart.sessions.UploadSessionService`."""
 
     files: FileStorageService
 
diff --git a/modules/file_storage/file_storage/uploads.py b/modules/file_storage/file_storage/multipart/sessions.py
similarity index 97%
rename from modules/file_storage/file_storage/uploads.py
rename to modules/file_storage/file_storage/multipart/sessions.py
index 01c967f8f..6de082f72 100644
--- a/modules/file_storage/file_storage/uploads.py
+++ b/modules/file_storage/file_storage/multipart/sessions.py
@@ -24,18 +24,19 @@
 from sqlalchemy import select
 from sqlmodel import col
 
-from file_storage import constants, queries
 from file_storage.contracts.schemas import StoredFileOut
 from file_storage.contracts.service import (
     NotSupportedError,
     Part,
     StorageNotFoundError,
 )
+from file_storage.core import constants
+from file_storage.core.scope import owning_tenant
+from file_storage.files import queries
+from file_storage.files.service import FileStorageService, FileTooLargeError, generate_key
 from file_storage.models import StoredFile, UploadSession
-from file_storage.scope import owning_tenant
-from file_storage.service import FileStorageService, FileTooLargeError, generate_key
-from file_storage.upload_guards import UploadGuards
-from file_storage.upload_support import (
+from file_storage.multipart.guards import UploadGuards
+from file_storage.multipart.support import (
     InvalidPartError,
     PartsMismatchError,
     QuotaExceededError,
diff --git a/modules/file_storage/file_storage/multipart/support.py b/modules/file_storage/file_storage/multipart/support.py
new file mode 100644
index 000000000..d7d530880
--- /dev/null
+++ b/modules/file_storage/file_storage/multipart/support.py
@@ -0,0 +1,78 @@
+"""Errors and part arithmetic for resumable uploads (#454)."""
+
+from __future__ import annotations
+
+import math
+import uuid
+from typing import TYPE_CHECKING
+
+from file_storage.core import constants
+
+if TYPE_CHECKING:
+    from file_storage.models import UploadSession
+
+
+class UploadNotFoundError(Exception):
+    """No such session for this user in this tenant (also: someone else's)."""
+
+
+class UploadClosedError(Exception):
+    """The session is completed, aborted or past its deadline."""
+
+
+class DirectUploadUnsupportedError(Exception):
+    """The active backend cannot do multipart uploads."""
+
+
+class QuotaExceededError(Exception):
+    """The file would not fit in the configured storage quota."""
+
+
+class StorageBusyError(Exception):
+    """Another upload holds the quota check; retry shortly (SQLite only)."""
+
+
+class InvalidPartError(Exception):
+    """A part number outside the file, or a part of the wrong size."""
+
+
+class PartsMismatchError(Exception):
+    """The backend does not hold the parts the client claims to have sent."""
+
+    def __init__(self, missing: list[int], mismatched: list[int]) -> None:
+        super().__init__(f"missing={missing} mismatched={mismatched}")
+        self.missing = missing
+        self.mismatched = mismatched
+
+
+class SizeMismatchError(Exception):
+    """The assembled object is not the size the session promised."""
+
+    def __init__(self, expected: int, actual: int) -> None:
+        super().__init__(f"expected {expected} bytes, assembled {actual}")
+        self.expected = expected
+        self.actual = actual
+
+
+def choose_part_size(total_size: int, preferred: int) -> int:
+    """``preferred``, grown (in whole MiB) until the file needs <= 10,000 parts."""
+    needed = math.ceil(total_size / constants.MAX_UPLOAD_PARTS)
+    size = max(preferred, needed)
+    return math.ceil(size / constants.MIB) * constants.MIB
+
+
+def total_parts(session: UploadSession) -> int:
+    return math.ceil(session.total_size / session.part_size)
+
+
+def expected_part_size(session: UploadSession, part_no: int) -> int:
+    if part_no < total_parts(session):
+        return session.part_size
+    return session.total_size - (total_parts(session) - 1) * session.part_size
+
+
+def part_path(upload_id: uuid.UUID, part_no: int) -> str:
+    """The app route that relays a part, for backends that cannot presign."""
+    return constants.ROUTE_PREFIX_API + constants.PATH_UPLOAD_PART.format(
+        upload_id=upload_id, part_no=part_no
+    )
diff --git a/modules/file_storage/file_storage/pages/Browse.tsx b/modules/file_storage/file_storage/pages/Browse.tsx
index 472e21e64..7abfe0416 100644
--- a/modules/file_storage/file_storage/pages/Browse.tsx
+++ b/modules/file_storage/file_storage/pages/Browse.tsx
@@ -10,18 +10,18 @@ import { Trash2 } from 'lucide-react';
 import { useCallback, useState } from 'react';
 import { toast } from 'sonner';
 
-import { BrowseEmpty } from './components/BrowseEmpty';
-import { DropzoneStrip } from './components/DropzoneStrip';
-import { FileFilterBar } from './components/FileFilterBar';
-import { FileTable } from './components/FileTable';
-import { SelectionFooter } from './components/SelectionFooter';
-import { UploadDropzone } from './components/UploadDropzone';
-import { UploadsCard } from './components/UploadsCard';
-import { PERMISSIONS, ROUTES } from './constants';
-import { describeTypes, formatBytes } from './format';
-import type { BrowseProps, FileFilters } from './types';
-import { useUploadQueue } from './upload-queue';
-import { useFileActions } from './use-file-actions';
+import { BrowseEmpty } from '../ui/components/BrowseEmpty';
+import { DropzoneStrip } from '../ui/components/DropzoneStrip';
+import { FileFilterBar } from '../ui/components/FileFilterBar';
+import { FileTable } from '../ui/components/FileTable';
+import { SelectionFooter } from '../ui/components/SelectionFooter';
+import { UploadDropzone } from '../ui/components/UploadDropzone';
+import { UploadsCard } from '../ui/components/UploadsCard';
+import { useFileActions } from '../ui/hooks/use-file-actions';
+import { PERMISSIONS, ROUTES } from '../ui/utils/constants';
+import { describeTypes, formatBytes } from '../ui/utils/format';
+import type { BrowseProps, FileFilters } from '../ui/utils/types';
+import { useUploadQueue } from '../ui/utils/upload-queue';
 
 function Browse(props: BrowseProps) {
   const { files, pagination, content_types: contentTypes, uploaders } = props;
diff --git a/modules/file_storage/file_storage/scope.py b/modules/file_storage/file_storage/scope.py
index f6169e538..00cfc0474 100644
--- a/modules/file_storage/file_storage/scope.py
+++ b/modules/file_storage/file_storage/scope.py
@@ -1,72 +1,11 @@
-"""Which tenant a stored file belongs to — and the one way to act as the platform.
-
-``StoredFile`` is ``MultiTenantMixin`` (#383): request code reads, writes and
-deletes only the bound tenant's files, and strict mode fails closed with no
-tenant bound. Two callers need something else, and both go through here:
-
-* **Upload** must know the owning tenant *before* the row exists, because the
-  storage key is prefixed with it and the bytes are written to the backend
-  before the row is flushed. :func:`owning_tenant` answers that the same way
-  the flush guard will, so a strict install with no tenant fails before any
-  object is written rather than after.
-* **Platform-owned files** — today, branding's logo and favicon — belong to no
-  tenant and must stay readable from anonymous requests, where no tenant is
-  bound at all. They are stamped :data:`PLATFORM_TENANT_ID` and read under
-  :func:`platform_scope`, restricted to that owner. The id is reserved in
-  ``simple_module_db`` — ``is_valid_tenant_id`` refuses it — so no request,
-  job or tenant can ever be bound to it, and it is distinct from
-  ``DEFAULT_TENANT_ID``, which owns a single-tenant install's ordinary rows.
-"""
+"""Moved to :mod:`file_storage.core.scope`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-from collections.abc import AsyncGenerator
-from contextlib import asynccontextmanager
-
-from simple_module_db import PLATFORM_TENANT_ID, all_tenants, current_tenant_id
-from simple_module_db.query_filter import fallback_tenant_id, is_strict
-from simple_module_db.tenancy import missing_tenant_error
-from sqlalchemy.ext.asyncio import AsyncSession
-
-
-def owning_tenant(db: AsyncSession, *, platform: bool = False) -> str:
-    """The tenant a new upload is stamped with, decided before the bytes move.
-
-    Bound tenant if there is one; ``PLATFORM_TENANT_ID`` for a platform upload;
-    on a non-strict install with nothing bound, the install's fallback
-    (``default_tenant`` or ``DEFAULT_TENANT_ID``) — the flush guard's own
-    choice. Strict with nothing bound raises ``MissingTenantError``.
-    """
-    if platform:
-        return PLATFORM_TENANT_ID
-    bound = current_tenant_id.get()
-    if bound:
-        return bound
-    if is_strict(db.sync_session):
-        raise missing_tenant_error("StoredFile", "INSERT")
-    return fallback_tenant_id(db.sync_session)
-
-
-@asynccontextmanager
-async def platform_scope(db: AsyncSession, platform: bool) -> AsyncGenerator[None]:
-    """``all_tenants()`` for platform-file access, a no-op otherwise.
-
-    Callers pair it with a ``tenant_id == PLATFORM_TENANT_ID`` condition, so
-    the bypass widens *which context* may read a platform file without letting
-    a platform caller reach any tenant's rows.
-
-    The bypass covers the session's whole flush, not one statement, so it must
-    never carry the caller's unrelated pending writes along: those are flushed
-    first, under the normal guard (stamped with, and checked against, the bound
-    tenant), and autoflush is off inside — only what the block itself adds or
-    changes is flushed with isolation lifted.
-    """
-    if not platform:
-        yield
-        return
-    await db.flush()
-    with db.no_autoflush, all_tenants():
-        yield
+import importlib
+import sys
 
+from simple_module_core.deprecation import deprecated_module
 
-__all__ = ["PLATFORM_TENANT_ID", "owning_tenant", "platform_scope"]
+deprecated_module("file_storage.scope", remove_in="0.0.46", use="file_storage.core.scope")
+sys.modules[__name__] = importlib.import_module("file_storage.core.scope")
diff --git a/modules/file_storage/file_storage/service.py b/modules/file_storage/file_storage/service.py
index 7cdfa839d..987b92590 100644
--- a/modules/file_storage/file_storage/service.py
+++ b/modules/file_storage/file_storage/service.py
@@ -1,216 +1,11 @@
-"""file_storage service — upload, download, delete orchestration.
-
-The read side (listing, paging, bucket totals) is mixed in from
-:mod:`file_storage.reads`, so this file stays about the half of the job
-that talks to a storage backend and mutates rows.
-"""
+"""Moved to :mod:`file_storage.files.service`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-import hashlib
-import logging
-import uuid
-from collections.abc import AsyncIterator
-from datetime import UTC, datetime
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-from fastapi import UploadFile
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlmodel import col
-
-from file_storage import constants, queries
-from file_storage.backend_guard import require_backend
-from file_storage.contracts.schemas import StoredFileOut
-from file_storage.deletes import FileStorageDeletes
-from file_storage.downloads import (
-    Download,
-    RedirectDownload,
-    StreamDownload,
-    presigned_download_url,
-)
-from file_storage.models import StoredFile
-from file_storage.reads import FileStorageReads
-from file_storage.scope import PLATFORM_TENANT_ID, owning_tenant, platform_scope
-from file_storage.upload_guards import StorageQuota
-from file_storage.visibility import FileStoragePublic
-
-if TYPE_CHECKING:
-    from file_storage.aggregates import AggregateCache
-    from file_storage.contracts.service import StorageBackend
-    from file_storage.settings import FileStorageSettings
-
-
-_logger = logging.getLogger(__name__)
-
-
-class FileTooLargeError(Exception):
-    """Raised when an upload exceeds the configured size limit."""
-
-
-class ContentTypeNotAllowedError(Exception):
-    """Raised when the upload's content type isn't in the allow-list."""
-
-
-class StoredFileNotFoundError(Exception):
-    """Raised when a StoredFile lookup misses; endpoints map this to HTTP 404."""
-
-
-class FileStorageService(FileStoragePublic, FileStorageReads, FileStorageDeletes, StorageQuota):
-    """Orchestrates validation, hashing, backend IO, and DB lifecycle."""
-
-    def __init__(
-        self,
-        db: AsyncSession,
-        backend: StorageBackend,
-        settings: FileStorageSettings,
-        aggregate_cache: AggregateCache | None = None,
-    ) -> None:
-        self.db = db
-        self.backend = backend
-        self.settings = settings
-        # Optional on purpose. The app-wide cache lives on ``app.state`` and is
-        # handed in by ``deps``; a service built directly — a test, a script —
-        # gets ``None`` and reads the database every time, which is what a
-        # caller checking "did my write land?" wants and what keeps a
-        # short-lived instance from serving numbers nobody invalidates.
-        self._aggregate_cache = aggregate_cache
-
-    # ── Upload ───────────────────────────────────────────────────────
-
-    async def upload(
-        self, upload: UploadFile, *, platform: bool = False, public: bool = False
-    ) -> StoredFileOut:
-        """Validate, stream-hash, persist to backend, and record metadata.
-
-        The row belongs to the bound tenant, or — with ``platform=True`` — to
-        no tenant (:data:`~file_storage.scope.PLATFORM_TENANT_ID`), for files
-        the whole install serves, such as branding images. The owner is
-        settled first: the key is prefixed with it, and a strict install with
-        no tenant must fail before an object is written, not after.
-        """
-        content_type = upload.content_type or "application/octet-stream"
-        self._check_content_type(content_type)
-        tenant_id = owning_tenant(self.db, platform=platform)
-
-        size = 0
-        sha = hashlib.sha256()
-        max_size = self.settings.max_file_size_bytes
-
-        async def _hashing_stream() -> AsyncIterator[bytes]:
-            nonlocal size
-            while True:
-                chunk = await upload.read(constants.DEFAULT_CHUNK_SIZE)
-                if not chunk:
-                    break
-                size += len(chunk)
-                if size > max_size:
-                    raise FileTooLargeError(f"Upload exceeds {max_size} bytes.")
-                sha.update(chunk)
-                yield chunk
-
-        key = generate_key(tenant_id, upload.filename or "file")
-        await self.backend.put(
-            key,
-            _hashing_stream(),
-            content_type=content_type,
-            # 0 means unknown: the backend spools, or streams multipart parts.
-            size=upload.size or 0,
-        )
-
-        # Compensation: on DB failure, drop the just-uploaded object. A
-        # cleanup-time exception must NOT replace the original failure —
-        # otherwise the operator chases the wrong root cause. We swallow
-        # the cleanup error after logging; the orphaned key can be reaped
-        # by a janitor sweep.
-        try:
-            await self._check_quota(size, reserve=True, platform=platform)
-            row = StoredFile(
-                tenant_id=tenant_id,
-                key=key,
-                filename=upload.filename or key,
-                content_type=content_type,
-                size_bytes=size,
-                backend=self.backend.backend_id,
-                checksum_sha256=sha.hexdigest(),
-                public=public,
-            )
-            async with platform_scope(self.db, platform):
-                self.db.add(row)
-                await self.db.flush()
-                await self.db.refresh(row)
-        except BaseException:
-            try:
-                await self.backend.delete(key)
-            except BaseException:
-                _logger.exception(
-                    "file_storage.cleanup_failed key=%s — original upload error follows",
-                    key,
-                )
-            raise
-
-        return StoredFileOut.model_validate(queries.to_out_dict(row))
-
-    def _check_content_type(self, content_type: str) -> None:
-        allowed = self.settings.allowed_content_types
-        if allowed is not None and content_type not in allowed:
-            raise ContentTypeNotAllowedError(f"Content-Type {content_type!r} not in allow-list.")
-
-    async def get(
-        self, file_id: uuid.UUID, *, platform: bool = False, owner: str | None = None
-    ) -> StoredFile:
-        """The bound tenant's file, or with ``platform=True`` a platform file.
-
-        Another tenant's id misses exactly like an unknown one. ``platform``
-        needs no tenant bound (anonymous branding requests have none) and only
-        ever matches a platform-owned row, so a tenant's file id handed to a
-        platform caller — say, pasted into a branding setting — still misses.
-        ``owner`` (``deps.get_owner_scope``) narrows it to one uploader's rows
-        the same way: someone else's file misses like an unknown id (#544).
-        """
-        stmt = queries.owned_by(select(StoredFile).where(col(StoredFile.id) == file_id), owner)
-        if platform:
-            stmt = stmt.where(StoredFile.tenant_id == PLATFORM_TENANT_ID)
-        async with platform_scope(self.db, platform):
-            row = (await self.db.execute(stmt)).scalar_one_or_none()
-        if row is None:
-            raise StoredFileNotFoundError(str(file_id))
-        return row
-
-    async def download(
-        self,
-        file_id: uuid.UUID,
-        *,
-        platform: bool = False,
-        open_body: bool = True,
-        owner: str | None = None,
-    ) -> Download:
-        """Return either a streamed body or a redirect URL.
-
-        Dispatch on ``backend.supports_presigned_url`` so the service stays
-        provider-agnostic — adding a new backend that supports presigning
-        works without touching this method.
-        """
-        row = await self.get(file_id, platform=platform, owner=owner)
-        require_backend(self.backend, row)
-        if self.backend.supports_presigned_url:
-            url = await presigned_download_url(
-                self.backend, row, self.settings.s3_presign_ttl_seconds, attachment=True
-            )
-            return RedirectDownload(file=row, url=url)
-        body = await self.backend.get(row.key) if open_body else None
-        return StreamDownload(file=row, body=body)
-
+import importlib
+import sys
 
-def generate_key(tenant_id: str, filename: str) -> str:
-    """Build a tenant-prefixed, date-sharded, collision-proof key.
+from simple_module_core.deprecation import deprecated_module
 
-    The ``{tenant_id}/`` prefix keeps each tenant's objects in a disjoint
-    namespace on the backend (one prefix to export, purge or bill per tenant).
-    Tenant ids are validated to ``TENANT_ID_PATTERN``, which has no ``/`` and
-    cannot be ``..``, so the prefix is always exactly one path segment.
-    """
-    today = datetime.now(UTC)
-    suffix = Path(filename).suffix
-    return f"{tenant_id}/{today:%Y/%m/%d}/{uuid.uuid4().hex}{suffix}"
+deprecated_module("file_storage.service", remove_in="0.0.46", use="file_storage.files.service")
+sys.modules[__name__] = importlib.import_module("file_storage.files.service")
diff --git a/modules/file_storage/file_storage/settings.py b/modules/file_storage/file_storage/settings.py
index 2666e6088..14fd99a43 100644
--- a/modules/file_storage/file_storage/settings.py
+++ b/modules/file_storage/file_storage/settings.py
@@ -1,187 +1,11 @@
-"""file_storage module settings (DB-backed).
-
-Construction no longer reads ``SM_FILE_STORAGE_*`` environment variables.
-Values come from pydantic defaults at boot, then get hydrated from the DB
-by the hosting lifespan before module ``on_startup`` runs. Runtime changes
-go through ``settings.module_settings.reload.apply_changes_and_reload``.
-
-Fields are grouped via ``json_schema_extra={"group": ...}`` so the admin UI
-can render them under their respective backend sections.
-"""
+"""Moved to :mod:`file_storage.core.settings`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-from pathlib import Path
-
-from pydantic import Field, field_validator, model_validator
-from pydantic_settings import SettingsConfigDict
-from simple_module_core.settings_base import DbBackedSettings
-from simple_module_core.stored_settings import field_error
-
-from file_storage import constants
-
-# "s3" is SigV2, kept only for legacy S3-compatible stores that lack SigV4.
-_SIGNATURE_VERSIONS = frozenset({"s3v4", "s3"})
-
-
-class FileStorageSettings(DbBackedSettings):
-    """Configuration for the file_storage module.
-
-    The active backend is selected by ``backend`` (matches a key in the
-    backend registry). All ``s3_*`` fields are optional unless ``backend``
-    selects S3, in which case the validator below enforces presence of
-    bucket + region. Custom backends supply their own validation by
-    subclassing or by reading additional fields at registration time.
-    """
-
-    # ``DbBackedSettings`` (not ``BaseSettings``) so the DB is genuinely the
-    # only source: omitting ``env_prefix`` would leave pydantic-settings
-    # reading each field from its bare name — GH #283.
-    model_config = SettingsConfigDict(extra="ignore")
-
-    backend: str = Field(
-        default=constants.DEFAULT_BACKEND, json_schema_extra={"requires_restart": True}
-    )
-
-    # Filesystem backend
-    fs_root_path: str = Field(
-        default=constants.DEFAULT_FS_ROOT,
-        json_schema_extra={"group": "Filesystem", "requires_restart": True},
-    )
-
-    # S3-compatible backend (works with AWS S3, MinIO, R2, etc.)
-    s3_bucket: str = Field(default="", json_schema_extra={"group": "S3", "requires_restart": True})
-    s3_region: str = Field(default="", json_schema_extra={"group": "S3", "requires_restart": True})
-    s3_access_key_id: str = Field(
-        default="", json_schema_extra={"group": "S3", "requires_restart": True}
-    )
-    s3_secret_access_key: str = Field(
-        default="", json_schema_extra={"group": "S3", "requires_restart": True}
-    )
-    s3_endpoint_url: str = Field(
-        default="",
-        json_schema_extra={"group": "S3", "requires_restart": True},
-        description="Custom endpoint for MinIO / R2. Blank uses AWS default.",
-    )
-    s3_public_endpoint_url: str = Field(
-        default="",
-        json_schema_extra={"group": "S3", "requires_restart": True},
-        description=(
-            "Browser-facing S3 endpoint used to presign direct part uploads, when it "
-            "differs from s3_endpoint_url (e.g. an internal MinIO hostname). Blank "
-            "falls back to s3_endpoint_url. Its origin is added to CSP connect-src."
-        ),
-    )
-    s3_signature_version: str = Field(
-        default="s3v4",
-        json_schema_extra={"group": "S3", "requires_restart": True},
-        description="Presign signature version. Keep s3v4; SigV2 is rejected by most providers.",
-    )
-    s3_presign_ttl_seconds: int = Field(
-        default=constants.DEFAULT_PRESIGN_TTL_SECONDS,
-        json_schema_extra={"group": "S3"},
-    )
-
-    # Limits
-    max_file_size_bytes: int = constants.DEFAULT_MAX_FILE_SIZE_BYTES
-    allowed_content_types: list[str] | None = Field(
-        default=None,
-        description="Whitelist of MIME types. None = any type allowed.",
-    )
-    # Enforced for plain uploads and resumable sessions: stored bytes plus
-    # unexpired active reservations. None leaves aggregate storage unlimited.
-    # Positive, and no larger than a browser can hold exactly: the screen and
-    # the settings editor read it as a JavaScript number (#548).
-    quota_bytes: int | None = Field(
-        default=None,
-        gt=0,
-        le=constants.MAX_JS_SAFE_INTEGER,
-        description=(
-            "Storage ceiling for stored files and active upload reservations. None = unlimited."
-        ),
-    )
-
-    public_files_cors: bool = Field(
-        default=True,
-        description=(
-            "Let any origin read public files cross-origin (no credentials), so a "
-            "page on another site can embed or range-read them. Applies at once."
-        ),
-    )
-
-    # Resumable / direct uploads (#454)
-    direct_upload_threshold_bytes: int = Field(
-        default=constants.DEFAULT_DIRECT_UPLOAD_THRESHOLD_BYTES,
-        gt=0,
-        description="Files larger than this upload in parts through a resumable session.",
-    )
-    max_direct_upload_bytes: int = Field(
-        default=constants.DEFAULT_MAX_DIRECT_UPLOAD_BYTES,
-        gt=0,
-        description="Largest file the resumable session flow accepts.",
-    )
-    multipart_part_size_bytes: int = Field(
-        default=constants.DEFAULT_PART_SIZE_BYTES,
-        ge=constants.MIN_PART_SIZE_BYTES,
-        # S3 refuses parts over 5 GiB; a larger value would fail every multipart put.
-        le=constants.MAX_S3_PART_SIZE_BYTES,
-        description="Preferred part size; grown automatically to stay under 10,000 parts.",
-    )
-    upload_session_ttl_seconds: int = Field(
-        default=constants.DEFAULT_UPLOAD_SESSION_TTL_SECONDS,
-        gt=0,
-        description="How long an unfinished upload session stays resumable.",
-    )
-    upload_session_retention_days: int = Field(
-        default=constants.DEFAULT_UPLOAD_SESSION_RETENTION_DAYS,
-        ge=0,
-        description="How long finished (completed or aborted) upload session rows are kept.",
-    )
-
-    @field_validator("s3_signature_version")
-    @classmethod
-    def _known_signature_version(cls, value: str) -> str:
-        # botocore only fails on an unknown version when the first client is
-        # built, so an admin-UI typo would otherwise surface as failed uploads.
-        if value not in _SIGNATURE_VERSIONS:
-            raise ValueError(f"s3_signature_version must be one of {sorted(_SIGNATURE_VERSIONS)}")
-        return value
-
-    @model_validator(mode="after")
-    def _validate_backend_config(self) -> FileStorageSettings:
-        """Enforce per-backend required fields.
-
-        We validate at config time rather than at backend construction so
-        misconfigured prod boots fail fast with a clear message instead of
-        deferring the error until the first upload.
-        """
-        if self.backend == constants.BackendId.S3:
-            missing = [
-                name
-                for name, value in (
-                    ("s3_bucket", self.s3_bucket),
-                    ("s3_region", self.s3_region),
-                )
-                if not value
-            ]
-            if missing:
-                # Located on the first missing field (declared after ``backend``) so
-                # the form shows it there; ``backend`` is related so lenient boot
-                # can fall back to the default backend instead of failing.
-                raise field_error(
-                    type(self),
-                    missing[0],
-                    "s3_config_incomplete",
-                    f"S3 backend selected but {', '.join(missing)} is not set.",
-                    value=getattr(self, missing[0]),
-                    related=["backend", "s3_bucket", "s3_region"],
-                )
-        return self
+import importlib
+import sys
 
-    def presign_endpoint_url(self) -> str:
-        """The endpoint browsers reach: ``s3_public_endpoint_url``, else ``s3_endpoint_url``."""
-        return self.s3_public_endpoint_url or self.s3_endpoint_url
+from simple_module_core.deprecation import deprecated_module
 
-    def resolved_fs_root(self) -> Path:
-        """Return ``fs_root_path`` as an absolute Path."""
-        return Path(self.fs_root_path).expanduser().resolve()
+deprecated_module("file_storage.settings", remove_in="0.0.46", use="file_storage.core.settings")
+sys.modules[__name__] = importlib.import_module("file_storage.core.settings")
diff --git a/modules/file_storage/file_storage/tasks.py b/modules/file_storage/file_storage/tasks.py
index fa982ae60..f32090f05 100644
--- a/modules/file_storage/file_storage/tasks.py
+++ b/modules/file_storage/file_storage/tasks.py
@@ -21,7 +21,7 @@
 from celery import shared_task
 from sqlmodel import col
 
-from file_storage import constants
+from file_storage.core import constants
 
 logger = logging.getLogger(__name__)
 
@@ -44,7 +44,7 @@
 
 
 def _backend_and_settings():
-    from file_storage.worker_support import backend_and_settings
+    from file_storage.core.worker_support import backend_and_settings
 
     return backend_and_settings()
 
@@ -150,10 +150,10 @@ def compute_checksum(file_id: str, tenant_id: str) -> str | None:
     from background_tasks.sync_db import sync_session
     from simple_module_db import tenant_context
 
-    from file_storage.backend_guard import require_backend
-    from file_storage.checksum import hash_object
+    from file_storage.backends.guard import require_backend
     from file_storage.contracts.service import StorageNotFoundError
     from file_storage.models import StoredFile
+    from file_storage.multipart.checksum import hash_object
 
     backend, _ = _backend_and_settings()
     target = uuid.UUID(file_id)
@@ -184,7 +184,7 @@ def reap_objects() -> int:
     """Reconcile completed objects, with twice the upload TTL as a safety window."""
     from background_tasks.sync_db import sync_session
 
-    from file_storage.object_reaper import reap_objects as reconcile
+    from file_storage.core.object_reaper import reap_objects as reconcile
 
     backend, settings = _backend_and_settings()
     return asyncio.run(
diff --git a/modules/file_storage/file_storage/tenant_deletion.py b/modules/file_storage/file_storage/tenant_deletion.py
index ab9682af8..9b61e20a9 100644
--- a/modules/file_storage/file_storage/tenant_deletion.py
+++ b/modules/file_storage/file_storage/tenant_deletion.py
@@ -1,149 +1,13 @@
-"""Durable tenant teardown, with backend work following the row-deletion commit."""
+"""Moved to :mod:`file_storage.core.tenant_deletion`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-import logging
-from dataclasses import dataclass
-from typing import TYPE_CHECKING
+import importlib
+import sys
 
-from simple_module_core.durable_events import DurableContext
-from simple_module_core.events import Event, EventBus
-from simple_module_core.tenant_events import TenantDeleted
-from simple_module_db import tenant_context
-from sqlmodel import col, delete, select
+from simple_module_core.deprecation import deprecated_module
 
-from file_storage import constants
-from file_storage.backends import build_backend
-from file_storage.contracts.service import StorageBackend, StorageNotFoundError
-from file_storage.models import StoredFile, UploadSession
-from file_storage.settings import FileStorageSettings
-from file_storage.thumbnails import variant_key
-
-if TYPE_CHECKING:
-    from fastapi import FastAPI
-
-_logger = logging.getLogger(__name__)
-
-CLEANUP_BATCH_SIZE = 500
-
-_PURGE_HANDLER = "file_storage.tenant_deletion.purge_rows"
-_OBJECT_HANDLER = "file_storage.tenant_deletion.purge_objects"
-
-
-@dataclass
-class TenantStorageCleanupRequested(Event):
-    """A persisted cleanup manifest, surviving deletion of the source rows."""
-
-    files: list[tuple[str, str]]
-    uploads: list[tuple[str, str | None]]
-
-
-def register_tenant_deletion(bus: EventBus, app: FastAPI | None) -> None:
-    """Register on both web and worker buses, including workers without an app."""
-
-    async def purge_rows(event: TenantDeleted, ctx: DurableContext) -> None:
-        with tenant_context(event.tenant_id):
-            for model, columns in (
-                (StoredFile, (StoredFile.backend, StoredFile.key)),
-                (
-                    UploadSession,
-                    (UploadSession.key, UploadSession.backend_upload_id, UploadSession.status),
-                ),
-            ):
-                result = await ctx.db.execute(
-                    select(*columns)
-                    .where(col(model.tenant_id) == event.tenant_id)
-                    .execution_options(include_deleted=True)
-                )
-                projected = result.all()
-                for start in range(0, len(projected), CLEANUP_BATCH_SIZE):
-                    rows = projected[start : start + CLEANUP_BATCH_SIZE]
-                    manifest = TenantStorageCleanupRequested(
-                        files=[(row[0], row[1]) for row in rows] if model is StoredFile else [],
-                        uploads=[
-                            (row[0], row[1])
-                            for row in rows
-                            if row[2] == constants.UploadStatus.ACTIVE
-                        ]
-                        if model is UploadSession
-                        else [],
-                    )
-                    if not manifest.files and not manifest.uploads:
-                        continue
-                    on_commit = getattr(ctx.db, "on_commit", None)
-                    if bus.durable_transport is not None:
-                        await bus.publish_durable(manifest, ctx.db)
-                    elif on_commit is not None:
-                        # Bind each chunk so callbacks cannot reuse the last manifest.
-                        on_commit(
-                            lambda manifest=manifest: bus.publish_durable_or_inline(
-                                manifest, ctx.db
-                            )
-                        )
-                    else:
-                        _logger.warning(
-                            "file_storage.tenant_cleanup_deferred tenant=%s objects=%d",
-                            event.tenant_id,
-                            len(manifest.files),
-                        )
-            for model in (UploadSession, StoredFile):
-                await ctx.db.execute(
-                    delete(model)
-                    .where(col(model.tenant_id) == event.tenant_id)
-                    .execution_options(include_deleted=True)
-                )
-
-    async def purge_objects(event: TenantStorageCleanupRequested, ctx: DurableContext) -> None:
-        # Run only after the row transaction commits. With a transport,
-        # failures retain the manifest in the outbox for idempotent retries.
-        settings = _settings(app)
-        backends: dict[str, StorageBackend] = {}
-        failures: list[Exception] = []
-
-        async def attempt(operation) -> None:
-            try:
-                await operation
-            except StorageNotFoundError:
-                pass
-            except Exception as exc:
-                failures.append(exc)
-
-        for backend_id, key in event.files:
-            if backend_id != settings.backend:
-                # Only the active provider is configured; building another from
-                # these settings would raise on every retry and wedge the rest.
-                _logger.warning(
-                    "file_storage.backend_mismatch key=%s stored=%s active=%s — object retained",
-                    key,
-                    backend_id,
-                    settings.backend,
-                )
-                continue
-            backend = backends.get(backend_id)
-            if backend is None:
-                backend = build_backend(settings.model_copy(update={"backend": backend_id}))
-                backends[backend_id] = backend
-            for target in [key, *(variant_key(key, w) for w in constants.THUMBNAIL_WIDTHS)]:
-                await attempt(backend.delete(target))
-        if event.uploads:
-            backend = build_backend(settings)
-            for key, upload_id in event.uploads:
-                if upload_id is None:
-                    continue
-                # Attempt the delete even if abort fails; retry the entire
-                # idempotent manifest on failure, bounded by outbox max attempts.
-                await attempt(backend.abort_multipart(key, upload_id))
-                await attempt(backend.delete(key))
-        if failures:
-            raise ExceptionGroup("Tenant storage cleanup failed", failures)
-
-    bus.subscribe_durable(TenantDeleted, purge_rows, name=_PURGE_HANDLER)
-    bus.subscribe_durable(TenantStorageCleanupRequested, purge_objects, name=_OBJECT_HANDLER)
-
-
-def _settings(app: FastAPI | None) -> FileStorageSettings:
-    if app is not None:
-        return app.state.file_storage.settings
-    from background_tasks import settings_for
-
-    return settings_for(FileStorageSettings, constants.MODULE_NAME)
+deprecated_module(
+    "file_storage.tenant_deletion", remove_in="0.0.46", use="file_storage.core.tenant_deletion"
+)
+sys.modules[__name__] = importlib.import_module("file_storage.core.tenant_deletion")
diff --git a/modules/file_storage/file_storage/pages/components/BrowseEmpty.tsx b/modules/file_storage/file_storage/ui/components/BrowseEmpty.tsx
similarity index 100%
rename from modules/file_storage/file_storage/pages/components/BrowseEmpty.tsx
rename to modules/file_storage/file_storage/ui/components/BrowseEmpty.tsx
diff --git a/modules/file_storage/file_storage/pages/components/DropzoneStrip.tsx b/modules/file_storage/file_storage/ui/components/DropzoneStrip.tsx
similarity index 100%
rename from modules/file_storage/file_storage/pages/components/DropzoneStrip.tsx
rename to modules/file_storage/file_storage/ui/components/DropzoneStrip.tsx
diff --git a/modules/file_storage/file_storage/pages/components/FileFilterBar.tsx b/modules/file_storage/file_storage/ui/components/FileFilterBar.tsx
similarity index 99%
rename from modules/file_storage/file_storage/pages/components/FileFilterBar.tsx
rename to modules/file_storage/file_storage/ui/components/FileFilterBar.tsx
index 65a4a9899..cb3de72ad 100644
--- a/modules/file_storage/file_storage/pages/components/FileFilterBar.tsx
+++ b/modules/file_storage/file_storage/ui/components/FileFilterBar.tsx
@@ -10,7 +10,7 @@ import {
 import { Search } from 'lucide-react';
 import { useEffect, useRef, useState } from 'react';
 
-import type { ContentTypeFacet, FileFilters, UploaderFacet } from '../types';
+import type { ContentTypeFacet, FileFilters, UploaderFacet } from '../utils/types';
 
 interface Props {
   filters: FileFilters;
diff --git a/modules/file_storage/file_storage/pages/components/FileTable.tsx b/modules/file_storage/file_storage/ui/components/FileTable.tsx
similarity index 97%
rename from modules/file_storage/file_storage/pages/components/FileTable.tsx
rename to modules/file_storage/file_storage/ui/components/FileTable.tsx
index fcdff3433..b38509ef7 100644
--- a/modules/file_storage/file_storage/pages/components/FileTable.tsx
+++ b/modules/file_storage/file_storage/ui/components/FileTable.tsx
@@ -14,9 +14,9 @@ import {
 import { useRelativeTime } from '@simple-module-py/ui/hooks/use-relative-time';
 import { cn } from '@simple-module-py/ui/lib/utils';
 
-import { ROUTES } from '../constants';
-import { formatBytes } from '../format';
-import type { StoredFile } from '../types';
+import { ROUTES } from '../utils/constants';
+import { formatBytes } from '../utils/format';
+import type { StoredFile } from '../utils/types';
 
 interface Props {
   files: StoredFile[];
diff --git a/modules/file_storage/file_storage/pages/components/SelectionFooter.tsx b/modules/file_storage/file_storage/ui/components/SelectionFooter.tsx
similarity index 97%
rename from modules/file_storage/file_storage/pages/components/SelectionFooter.tsx
rename to modules/file_storage/file_storage/ui/components/SelectionFooter.tsx
index e6fdf8f32..f4506f17c 100644
--- a/modules/file_storage/file_storage/pages/components/SelectionFooter.tsx
+++ b/modules/file_storage/file_storage/ui/components/SelectionFooter.tsx
@@ -1,7 +1,7 @@
 import { keys, useT } from '@simple-module-py/i18n';
 import { Button } from '@simple-module-py/ui/components/ui/button';
 
-import type { Pagination } from '../types';
+import type { Pagination } from '../utils/types';
 
 interface Props {
   pagination: Pagination;
diff --git a/modules/file_storage/file_storage/pages/components/UploadDropzone.tsx b/modules/file_storage/file_storage/ui/components/UploadDropzone.tsx
similarity index 100%
rename from modules/file_storage/file_storage/pages/components/UploadDropzone.tsx
rename to modules/file_storage/file_storage/ui/components/UploadDropzone.tsx
diff --git a/modules/file_storage/file_storage/pages/components/UploadsCard.tsx b/modules/file_storage/file_storage/ui/components/UploadsCard.tsx
similarity index 98%
rename from modules/file_storage/file_storage/pages/components/UploadsCard.tsx
rename to modules/file_storage/file_storage/ui/components/UploadsCard.tsx
index 74db6d5a6..e7ba57550 100644
--- a/modules/file_storage/file_storage/pages/components/UploadsCard.tsx
+++ b/modules/file_storage/file_storage/ui/components/UploadsCard.tsx
@@ -4,7 +4,7 @@ import { Card } from '@simple-module-py/ui/components/ui/card';
 import { Progress } from '@simple-module-py/ui/components/ui/progress';
 import { X } from 'lucide-react';
 
-import type { UploadJob } from '../upload-queue';
+import type { UploadJob } from '../utils/upload-queue';
 
 export interface UploadActions {
   cancel: (id: string) => void;
diff --git a/modules/file_storage/file_storage/pages/use-file-actions.ts b/modules/file_storage/file_storage/ui/hooks/use-file-actions.ts
similarity index 95%
rename from modules/file_storage/file_storage/pages/use-file-actions.ts
rename to modules/file_storage/file_storage/ui/hooks/use-file-actions.ts
index dd3636fa0..d3161d5fb 100644
--- a/modules/file_storage/file_storage/pages/use-file-actions.ts
+++ b/modules/file_storage/file_storage/ui/hooks/use-file-actions.ts
@@ -3,9 +3,9 @@ import { keys, useT } from '@simple-module-py/i18n';
 import { apiResult } from '@simple-module-py/ui/lib/api';
 import { useState } from 'react';
 import { toast } from 'sonner';
-import { api } from './api';
-import { RELOAD_PROPS } from './constants';
-import type { StoredFile } from './types';
+import { api } from '../../pages/api';
+import { RELOAD_PROPS } from '../utils/constants';
+import type { StoredFile } from '../utils/types';
 
 interface Options {
   files: StoredFile[];
diff --git a/modules/file_storage/file_storage/pages/constants.ts b/modules/file_storage/file_storage/ui/utils/constants.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/constants.ts
rename to modules/file_storage/file_storage/ui/utils/constants.ts
diff --git a/modules/file_storage/file_storage/pages/format.ts b/modules/file_storage/file_storage/ui/utils/format.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/format.ts
rename to modules/file_storage/file_storage/ui/utils/format.ts
diff --git a/modules/file_storage/file_storage/pages/resumable-upload.ts b/modules/file_storage/file_storage/ui/utils/resumable-upload.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/resumable-upload.ts
rename to modules/file_storage/file_storage/ui/utils/resumable-upload.ts
diff --git a/modules/file_storage/file_storage/pages/resume-store.ts b/modules/file_storage/file_storage/ui/utils/resume-store.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/resume-store.ts
rename to modules/file_storage/file_storage/ui/utils/resume-store.ts
diff --git a/modules/file_storage/file_storage/pages/types.ts b/modules/file_storage/file_storage/ui/utils/types.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/types.ts
rename to modules/file_storage/file_storage/ui/utils/types.ts
diff --git a/modules/file_storage/file_storage/pages/upload-errors.ts b/modules/file_storage/file_storage/ui/utils/upload-errors.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/upload-errors.ts
rename to modules/file_storage/file_storage/ui/utils/upload-errors.ts
diff --git a/modules/file_storage/file_storage/pages/upload-queue.ts b/modules/file_storage/file_storage/ui/utils/upload-queue.ts
similarity index 100%
rename from modules/file_storage/file_storage/pages/upload-queue.ts
rename to modules/file_storage/file_storage/ui/utils/upload-queue.ts
diff --git a/modules/file_storage/file_storage/upload_support.py b/modules/file_storage/file_storage/upload_support.py
index e2162d90a..07a4541b9 100644
--- a/modules/file_storage/file_storage/upload_support.py
+++ b/modules/file_storage/file_storage/upload_support.py
@@ -1,78 +1,13 @@
-"""Errors and part arithmetic for resumable uploads (#454)."""
+"""Moved to :mod:`file_storage.multipart.support`; this alias goes in 0.0.46 (module layout)."""
 
 from __future__ import annotations
 
-import math
-import uuid
-from typing import TYPE_CHECKING
+import importlib
+import sys
 
-from file_storage import constants
+from simple_module_core.deprecation import deprecated_module
 
-if TYPE_CHECKING:
-    from file_storage.models import UploadSession
-
-
-class UploadNotFoundError(Exception):
-    """No such session for this user in this tenant (also: someone else's)."""
-
-
-class UploadClosedError(Exception):
-    """The session is completed, aborted or past its deadline."""
-
-
-class DirectUploadUnsupportedError(Exception):
-    """The active backend cannot do multipart uploads."""
-
-
-class QuotaExceededError(Exception):
-    """The file would not fit in the configured storage quota."""
-
-
-class StorageBusyError(Exception):
-    """Another upload holds the quota check; retry shortly (SQLite only)."""
-
-
-class InvalidPartError(Exception):
-    """A part number outside the file, or a part of the wrong size."""
-
-
-class PartsMismatchError(Exception):
-    """The backend does not hold the parts the client claims to have sent."""
-
-    def __init__(self, missing: list[int], mismatched: list[int]) -> None:
-        super().__init__(f"missing={missing} mismatched={mismatched}")
-        self.missing = missing
-        self.mismatched = mismatched
-
-
-class SizeMismatchError(Exception):
-    """The assembled object is not the size the session promised."""
-
-    def __init__(self, expected: int, actual: int) -> None:
-        super().__init__(f"expected {expected} bytes, assembled {actual}")
-        self.expected = expected
-        self.actual = actual
-
-
-def choose_part_size(total_size: int, preferred: int) -> int:
-    """``preferred``, grown (in whole MiB) until the file needs <= 10,000 parts."""
-    needed = math.ceil(total_size / constants.MAX_UPLOAD_PARTS)
-    size = max(preferred, needed)
-    return math.ceil(size / constants.MIB) * constants.MIB
-
-
-def total_parts(session: UploadSession) -> int:
-    return math.ceil(session.total_size / session.part_size)
-
-
-def expected_part_size(session: UploadSession, part_no: int) -> int:
-    if part_no < total_parts(session):
-        return session.part_size
-    return session.total_size - (total_parts(session) - 1) * session.part_size
-
-
-def part_path(upload_id: uuid.UUID, part_no: int) -> str:
-    """The app route that relays a part, for backends that cannot presign."""
-    return constants.ROUTE_PREFIX_API + constants.PATH_UPLOAD_PART.format(
-        upload_id=upload_id, part_no=part_no
-    )
+deprecated_module(
+    "file_storage.upload_support", remove_in="0.0.46", use="file_storage.multipart.support"
+)
+sys.modules[__name__] = importlib.import_module("file_storage.multipart.support")
diff --git a/modules/file_storage/file_storage/web/__init__.py b/modules/file_storage/file_storage/web/__init__.py
new file mode 100644
index 000000000..5eb2785c8
--- /dev/null
+++ b/modules/file_storage/file_storage/web/__init__.py
@@ -0,0 +1,6 @@
+"""The HTTP side.
+
+Request deps, body limits, byte serving, cookieless public responses, CORS and
+CSP for public reads and direct uploads, and the REST, public, upload and
+Inertia endpoints.
+"""
diff --git a/modules/file_storage/file_storage/body_limits.py b/modules/file_storage/file_storage/web/body_limits.py
similarity index 92%
rename from modules/file_storage/file_storage/body_limits.py
rename to modules/file_storage/file_storage/web/body_limits.py
index 175e3118d..f42484126 100644
--- a/modules/file_storage/file_storage/body_limits.py
+++ b/modules/file_storage/file_storage/web/body_limits.py
@@ -4,8 +4,8 @@
 
 from simple_module_core.body_limits import BodyLimitRegistry
 
-from file_storage import constants
-from file_storage.upload_support import choose_part_size
+from file_storage.core import constants
+from file_storage.multipart.support import choose_part_size
 
 
 def register_upload_body_limits(registry: BodyLimitRegistry) -> None:
diff --git a/modules/file_storage/file_storage/cookieless.py b/modules/file_storage/file_storage/web/cookieless.py
similarity index 98%
rename from modules/file_storage/file_storage/cookieless.py
rename to modules/file_storage/file_storage/web/cookieless.py
index 5c59335e5..8ceb8fc48 100644
--- a/modules/file_storage/file_storage/cookieless.py
+++ b/modules/file_storage/file_storage/web/cookieless.py
@@ -27,7 +27,7 @@
 
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
-from file_storage import constants
+from file_storage.core import constants
 
 PUBLIC_PATH_PATTERN = (
     rf"{re.escape(constants.ROUTE_PREFIX_API + constants.PUBLIC_SEGMENT)}/[^/]+(/[^/]+)?$"
diff --git a/modules/file_storage/file_storage/cors.py b/modules/file_storage/file_storage/web/cors.py
similarity index 93%
rename from modules/file_storage/file_storage/cors.py
rename to modules/file_storage/file_storage/web/cors.py
index 5c73651c0..7e69b3112 100644
--- a/modules/file_storage/file_storage/cors.py
+++ b/modules/file_storage/file_storage/web/cors.py
@@ -15,8 +15,8 @@
 
 from simple_module_core.cors import WILDCARD, CorsPolicy, CorsPolicyRegistry
 
-from file_storage import constants
-from file_storage.cookieless import PUBLIC_PATH_PATTERN
+from file_storage.core import constants
+from file_storage.web.cookieless import PUBLIC_PATH_PATTERN
 
 if TYPE_CHECKING:
     from fastapi import FastAPI
diff --git a/modules/file_storage/file_storage/csp.py b/modules/file_storage/file_storage/web/csp.py
similarity index 92%
rename from modules/file_storage/file_storage/csp.py
rename to modules/file_storage/file_storage/web/csp.py
index 83ac3a23a..17aa16fa1 100644
--- a/modules/file_storage/file_storage/csp.py
+++ b/modules/file_storage/file_storage/web/csp.py
@@ -5,12 +5,12 @@
 from typing import TYPE_CHECKING
 from urllib.parse import urlsplit
 
-from file_storage import constants
+from file_storage.core import constants
 
 if TYPE_CHECKING:
     from fastapi import FastAPI
 
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
 
 
 def s3_connect_origins(settings: FileStorageSettings) -> list[str]:
diff --git a/modules/file_storage/file_storage/web/deps.py b/modules/file_storage/file_storage/web/deps.py
new file mode 100644
index 000000000..dffd5383b
--- /dev/null
+++ b/modules/file_storage/file_storage/web/deps.py
@@ -0,0 +1,58 @@
+"""FastAPI dependencies for the file_storage module."""
+
+from __future__ import annotations
+
+from fastapi import Depends, Request
+from simple_module_core.events import EventBus
+from simple_module_core.permissions import grants
+from simple_module_db.deps import get_db
+from simple_module_db.listeners import current_user_id
+from simple_module_hosting.permissions import ensure_resolved_permissions
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from file_storage.core import constants
+from file_storage.core.services import FileStorageServices
+from file_storage.files.service import FileStorageService
+
+# Matches no row: ``created_by`` is a user id or NULL, never the empty string.
+NO_OWNER = ""
+
+
+async def get_file_storage_services(request: Request) -> FileStorageServices:
+    return request.app.state.file_storage
+
+
+async def get_file_storage_service(
+    db: AsyncSession = Depends(get_db),
+    services: FileStorageServices = Depends(get_file_storage_services),
+) -> FileStorageService:
+    if services.backend is None:
+        raise RuntimeError("file_storage backend is not initialised (on_startup has not run)")
+    return FileStorageService(db, services.backend, services.settings, services.aggregates)
+
+
+async def get_owner_scope(request: Request) -> str | None:
+    """Whose files this request may see and change (#544).
+
+    ``None`` — every file in the active tenant — for a caller holding
+    ``file_storage.manage`` (platform admins via the wildcard, organisation
+    admins and owners). Anyone else is confined to the rows they uploaded: the
+    id is read from the same ``current_user_id`` the audit listener stamps
+    ``created_by`` with, so the two cannot disagree. A principal with no id
+    gets :data:`NO_OWNER`, which matches nothing rather than everything.
+
+    Endpoints hand the result to the service, which applies it in the query —
+    so another user's file misses exactly like an unknown id (404, not 403).
+    Internal callers (branding, reapers, tasks) never pass it and stay
+    unscoped.
+    """
+    if grants(await ensure_resolved_permissions(request), constants.Permission.MANAGE):
+        return None
+    return current_user_id.get() or NO_OWNER
+
+
+OwnerScope = Depends(get_owner_scope)
+
+
+async def get_event_bus(request: Request) -> EventBus:
+    return request.app.state.sm.event_bus
diff --git a/modules/file_storage/file_storage/endpoints/__init__.py b/modules/file_storage/file_storage/web/endpoints/__init__.py
similarity index 100%
rename from modules/file_storage/file_storage/endpoints/__init__.py
rename to modules/file_storage/file_storage/web/endpoints/__init__.py
diff --git a/modules/file_storage/file_storage/endpoints/api.py b/modules/file_storage/file_storage/web/endpoints/api.py
similarity index 93%
rename from modules/file_storage/file_storage/endpoints/api.py
rename to modules/file_storage/file_storage/web/endpoints/api.py
index 51ec1c5e9..876fe2189 100644
--- a/modules/file_storage/file_storage/endpoints/api.py
+++ b/modules/file_storage/file_storage/web/endpoints/api.py
@@ -26,7 +26,6 @@
 from simple_module_hosting.pagination import page_params
 from simple_module_hosting.permissions import RequiresPermission
 
-from file_storage import constants, queries
 from file_storage.contracts.events import FileDeleted, FileUploaded
 from file_storage.contracts.schemas import (
     BulkDeleteRequest,
@@ -36,12 +35,12 @@
     StoredFileUpdate,
 )
 from file_storage.contracts.service import StorageNotFoundError
-from file_storage.deps import OwnerScope, get_event_bus, get_file_storage_service
-from file_storage.downloads import content_disposition
-from file_storage.endpoints.upload_errors import busy, quota
-from file_storage.format import format_bytes
-from file_storage.ranges import file_body_response
-from file_storage.service import (
+from file_storage.core import constants
+from file_storage.core.format import format_bytes
+from file_storage.files import queries
+from file_storage.files.downloads import content_disposition
+from file_storage.files.ranges import file_body_response
+from file_storage.files.service import (
     ContentTypeNotAllowedError,
     FileStorageService,
     FileTooLargeError,
@@ -49,8 +48,10 @@
     StoredFileNotFoundError,
     StreamDownload,
 )
-from file_storage.serving import etag_for, not_found, sandbox_headers, thumbnail_response
-from file_storage.upload_support import QuotaExceededError, StorageBusyError
+from file_storage.multipart.support import QuotaExceededError, StorageBusyError
+from file_storage.web.deps import OwnerScope, get_event_bus, get_file_storage_service
+from file_storage.web.endpoints.upload_errors import busy, quota
+from file_storage.web.serving import etag_for, not_found, sandbox_headers, thumbnail_response
 
 router = APIRouter()
 
diff --git a/modules/file_storage/file_storage/endpoints/public.py b/modules/file_storage/file_storage/web/endpoints/public.py
similarity index 89%
rename from modules/file_storage/file_storage/endpoints/public.py
rename to modules/file_storage/file_storage/web/endpoints/public.py
index 0528c7246..342876a73 100644
--- a/modules/file_storage/file_storage/endpoints/public.py
+++ b/modules/file_storage/file_storage/web/endpoints/public.py
@@ -13,12 +13,12 @@
 from simple_module_db.query_filter import strict_configured
 from simple_module_hosting.i18n_deps import TranslatorDep
 
-from file_storage import constants
-from file_storage.deps import get_file_storage_service
-from file_storage.scope import PLATFORM_TENANT_ID
-from file_storage.service import FileStorageService, StoredFileNotFoundError
-from file_storage.serving import not_found, public_file_response, thumbnail_response
-from file_storage.tenant_cache import cached_tenant_exists
+from file_storage.core import constants
+from file_storage.core.scope import PLATFORM_TENANT_ID
+from file_storage.core.tenant_cache import cached_tenant_exists
+from file_storage.files.service import FileStorageService, StoredFileNotFoundError
+from file_storage.web.deps import get_file_storage_service
+from file_storage.web.serving import not_found, public_file_response, thumbnail_response
 
 router = APIRouter()
 
diff --git a/modules/file_storage/file_storage/endpoints/upload_errors.py b/modules/file_storage/file_storage/web/endpoints/upload_errors.py
similarity index 90%
rename from modules/file_storage/file_storage/endpoints/upload_errors.py
rename to modules/file_storage/file_storage/web/endpoints/upload_errors.py
index 2c6578165..148dc3d90 100644
--- a/modules/file_storage/file_storage/endpoints/upload_errors.py
+++ b/modules/file_storage/file_storage/web/endpoints/upload_errors.py
@@ -5,11 +5,11 @@
 from fastapi import HTTPException, status
 from fastapi.responses import JSONResponse
 
-from file_storage import constants
-from file_storage.format import format_bytes
-from file_storage.service import FileTooLargeError
-from file_storage.upload_support import QuotaExceededError, SizeMismatchError
-from file_storage.uploads import UploadSessionService
+from file_storage.core import constants
+from file_storage.core.format import format_bytes
+from file_storage.files.service import FileTooLargeError
+from file_storage.multipart.sessions import UploadSessionService
+from file_storage.multipart.support import QuotaExceededError, SizeMismatchError
 
 
 def error(t, status_code: int, code: str, key: str, **fmt) -> HTTPException:
diff --git a/modules/file_storage/file_storage/endpoints/uploads.py b/modules/file_storage/file_storage/web/endpoints/uploads.py
similarity index 94%
rename from modules/file_storage/file_storage/endpoints/uploads.py
rename to modules/file_storage/file_storage/web/endpoints/uploads.py
index c6ba819f4..b4419833f 100644
--- a/modules/file_storage/file_storage/endpoints/uploads.py
+++ b/modules/file_storage/file_storage/web/endpoints/uploads.py
@@ -16,8 +16,6 @@
 from simple_module_hosting.i18n_deps import TranslatorDep
 from simple_module_hosting.permissions import RequiresPermission
 
-from file_storage import constants
-from file_storage.checksum import schedule_checksum
 from file_storage.contracts.events import FileUploaded
 from file_storage.contracts.schemas import (
     PartOut,
@@ -27,21 +25,16 @@
     UploadSessionCreate,
     UploadSessionOut,
 )
-from file_storage.deps import get_event_bus, get_file_storage_service
-from file_storage.endpoints.upload_errors import (
-    bad_part,
-    busy,
-    closed,
-    committed,
-    error,
-    not_found,
-    quota,
-    rejection,
-    too_large,
+from file_storage.core import constants
+from file_storage.files.service import (
+    ContentTypeNotAllowedError,
+    FileStorageService,
+    FileTooLargeError,
 )
 from file_storage.models import UploadSession
-from file_storage.service import ContentTypeNotAllowedError, FileStorageService, FileTooLargeError
-from file_storage.upload_support import (
+from file_storage.multipart.checksum import schedule_checksum
+from file_storage.multipart.sessions import UploadSessionService
+from file_storage.multipart.support import (
     DirectUploadUnsupportedError,
     InvalidPartError,
     PartsMismatchError,
@@ -52,7 +45,18 @@
     UploadNotFoundError,
     total_parts,
 )
-from file_storage.uploads import UploadSessionService
+from file_storage.web.deps import get_event_bus, get_file_storage_service
+from file_storage.web.endpoints.upload_errors import (
+    bad_part,
+    busy,
+    closed,
+    committed,
+    error,
+    not_found,
+    quota,
+    rejection,
+    too_large,
+)
 
 router = APIRouter(dependencies=[Depends(RequiresPermission(constants.Permission.UPLOAD))])
 
diff --git a/modules/file_storage/file_storage/endpoints/views.py b/modules/file_storage/file_storage/web/endpoints/views.py
similarity index 95%
rename from modules/file_storage/file_storage/endpoints/views.py
rename to modules/file_storage/file_storage/web/endpoints/views.py
index a00d04e4e..f42adf988 100644
--- a/modules/file_storage/file_storage/endpoints/views.py
+++ b/modules/file_storage/file_storage/web/endpoints/views.py
@@ -12,12 +12,12 @@
 from simple_module_inertia import InertiaResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from file_storage import constants
-from file_storage.aggregates import StorageAggregates
 from file_storage.contracts.schemas import StoredFileOut
-from file_storage.deps import OwnerScope, get_file_storage_service
-from file_storage.resolve import label_for, resolve_uploader_labels
-from file_storage.service import FileStorageService
+from file_storage.core import constants
+from file_storage.files.aggregates import StorageAggregates
+from file_storage.files.resolve import label_for, resolve_uploader_labels
+from file_storage.files.service import FileStorageService
+from file_storage.web.deps import OwnerScope, get_file_storage_service
 
 router = APIRouter()
 
diff --git a/modules/file_storage/file_storage/serving.py b/modules/file_storage/file_storage/web/serving.py
similarity index 92%
rename from modules/file_storage/file_storage/serving.py
rename to modules/file_storage/file_storage/web/serving.py
index 29ed02ffa..1c22e9145 100644
--- a/modules/file_storage/file_storage/serving.py
+++ b/modules/file_storage/file_storage/web/serving.py
@@ -6,14 +6,15 @@
 from fastapi import HTTPException, Request, Response, status
 from fastapi.responses import RedirectResponse
 
-from file_storage import constants, thumbnails
-from file_storage.backend_guard import require_backend
+from file_storage.backends.guard import require_backend
 from file_storage.contracts.service import StorageNotFoundError
-from file_storage.downloads import content_disposition, presigned_download_url
-from file_storage.media_types import is_active_content
+from file_storage.core import constants
+from file_storage.files import thumbnails
+from file_storage.files.downloads import content_disposition, presigned_download_url
+from file_storage.files.media_types import is_active_content
+from file_storage.files.ranges import file_body_response
+from file_storage.files.service import FileStorageService
 from file_storage.models import StoredFile
-from file_storage.ranges import file_body_response
-from file_storage.service import FileStorageService
 
 
 def etag_for(row: StoredFile, suffix: str = "") -> str:
diff --git a/modules/file_storage/tests-js/FileTable.test.tsx b/modules/file_storage/tests-js/FileTable.test.tsx
index 6fd99ce0b..0a4529d42 100644
--- a/modules/file_storage/tests-js/FileTable.test.tsx
+++ b/modules/file_storage/tests-js/FileTable.test.tsx
@@ -22,8 +22,8 @@ configureI18n({
   },
 });
 
-import { FileTable } from '../file_storage/pages/components/FileTable';
-import type { StoredFile } from '../file_storage/pages/types';
+import { FileTable } from '../file_storage/ui/components/FileTable';
+import type { StoredFile } from '../file_storage/ui/utils/types';
 
 const FILES: StoredFile[] = [
   {
diff --git a/modules/file_storage/tests-js/SelectionFooter.test.tsx b/modules/file_storage/tests-js/SelectionFooter.test.tsx
index 2f8b4ad62..2f4af3a12 100644
--- a/modules/file_storage/tests-js/SelectionFooter.test.tsx
+++ b/modules/file_storage/tests-js/SelectionFooter.test.tsx
@@ -11,7 +11,7 @@ import { configureI18n } from '@simple-module-py/i18n';
 import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { describe, expect, test, vi } from 'vitest';
-import { SelectionFooter } from '../file_storage/pages/components/SelectionFooter';
+import { SelectionFooter } from '../file_storage/ui/components/SelectionFooter';
 
 configureI18n({
   locale: 'en',
diff --git a/modules/file_storage/tests-js/file_storage_upload_queue_cancellation.test.ts b/modules/file_storage/tests-js/file_storage_upload_queue_cancellation.test.ts
index 21fc89d3a..a276179ef 100644
--- a/modules/file_storage/tests-js/file_storage_upload_queue_cancellation.test.ts
+++ b/modules/file_storage/tests-js/file_storage_upload_queue_cancellation.test.ts
@@ -7,12 +7,12 @@ vi.mock('@inertiajs/react', () => ({
   },
 }));
 
-vi.mock('../file_storage/pages/constants', async (importOriginal) => ({
-  ...(await importOriginal<typeof import('../file_storage/pages/constants')>()),
+vi.mock('../file_storage/ui/utils/constants', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../file_storage/ui/utils/constants')>()),
   UPLOAD_CONCURRENCY: 1,
 }));
 
-import { useUploadQueue } from '../file_storage/pages/upload-queue';
+import { useUploadQueue } from '../file_storage/ui/utils/upload-queue';
 
 class PendingXhr {
   static instances: PendingXhr[] = [];
diff --git a/modules/file_storage/tests-js/file_storage_upload_queue_lifecycle.test.ts b/modules/file_storage/tests-js/file_storage_upload_queue_lifecycle.test.ts
index 5bf75e06a..b84e0e443 100644
--- a/modules/file_storage/tests-js/file_storage_upload_queue_lifecycle.test.ts
+++ b/modules/file_storage/tests-js/file_storage_upload_queue_lifecycle.test.ts
@@ -23,14 +23,14 @@ vi.mock('react', async (importOriginal) => {
   };
 });
 vi.mock('@inertiajs/react', () => ({ router: { reload } }));
-vi.mock('../file_storage/pages/resumable-upload', () => ({
+vi.mock('../file_storage/ui/utils/resumable-upload', () => ({
   findSession,
   runResumable,
   discardSession,
 }));
 
-import type { RemoteSession } from '../file_storage/pages/resumable-upload';
-import { useUploadQueue } from '../file_storage/pages/upload-queue';
+import type { RemoteSession } from '../file_storage/ui/utils/resumable-upload';
+import { useUploadQueue } from '../file_storage/ui/utils/upload-queue';
 
 function deferred<T>() {
   let resolve!: (value: T) => void;
diff --git a/modules/file_storage/tests-js/file_storage_useFileActions.test.tsx b/modules/file_storage/tests-js/file_storage_useFileActions.test.tsx
index 1e8f72641..01ea055ee 100644
--- a/modules/file_storage/tests-js/file_storage_useFileActions.test.tsx
+++ b/modules/file_storage/tests-js/file_storage_useFileActions.test.tsx
@@ -9,8 +9,8 @@ vi.mock('@inertiajs/react', () => ({ router: { reload } }));
 vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn(), info: vi.fn() } }));
 
 import { toast } from 'sonner';
-import type { StoredFile } from '../file_storage/pages/types';
-import { useFileActions } from '../file_storage/pages/use-file-actions';
+import { useFileActions } from '../file_storage/ui/hooks/use-file-actions';
+import type { StoredFile } from '../file_storage/ui/utils/types';
 
 const files = [
   { id: 'a', filename: 'a.txt', public: false },
diff --git a/modules/file_storage/tests-js/format.test.ts b/modules/file_storage/tests-js/format.test.ts
index e7ea48be8..9edae43af 100644
--- a/modules/file_storage/tests-js/format.test.ts
+++ b/modules/file_storage/tests-js/format.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'vitest';
 
-import { describeTypes, formatBytes } from '../file_storage/pages/format';
+import { describeTypes, formatBytes } from '../file_storage/ui/utils/format';
 
 describe('formatBytes', () => {
   test.each([
diff --git a/modules/file_storage/tests-js/resumable-queue.test.ts b/modules/file_storage/tests-js/resumable-queue.test.ts
index 62b6d39d0..1e2871b9e 100644
--- a/modules/file_storage/tests-js/resumable-queue.test.ts
+++ b/modules/file_storage/tests-js/resumable-queue.test.ts
@@ -10,14 +10,14 @@ vi.mock('@inertiajs/react', () => ({
 const runResumable = vi.fn();
 const findSession = vi.fn();
 const discardSession = vi.fn();
-vi.mock('../file_storage/pages/resumable-upload', () => ({
+vi.mock('../file_storage/ui/utils/resumable-upload', () => ({
   runResumable: (...args: unknown[]) => runResumable(...args),
   findSession: (...args: unknown[]) => findSession(...args),
   discardSession: (...args: unknown[]) => discardSession(...args),
 }));
 
-import { UploadAbortedError, UploadFailedError } from '../file_storage/pages/upload-errors';
-import { useUploadQueue } from '../file_storage/pages/upload-queue';
+import { UploadAbortedError, UploadFailedError } from '../file_storage/ui/utils/upload-errors';
+import { useUploadQueue } from '../file_storage/ui/utils/upload-queue';
 
 const THRESHOLD = 100;
 
diff --git a/modules/file_storage/tests-js/resumable-upload.test.ts b/modules/file_storage/tests-js/resumable-upload.test.ts
index 39ba8a0b6..8776485f2 100644
--- a/modules/file_storage/tests-js/resumable-upload.test.ts
+++ b/modules/file_storage/tests-js/resumable-upload.test.ts
@@ -5,9 +5,9 @@ import {
   findSession,
   PART_CONCURRENCY,
   runResumable,
-} from '../file_storage/pages/resumable-upload';
-import { resumeKey } from '../file_storage/pages/resume-store';
-import { UploadAbortedError, UploadFailedError } from '../file_storage/pages/upload-errors';
+} from '../file_storage/ui/utils/resumable-upload';
+import { resumeKey } from '../file_storage/ui/utils/resume-store';
+import { UploadAbortedError, UploadFailedError } from '../file_storage/ui/utils/upload-errors';
 
 const PART = 10;
 
diff --git a/modules/file_storage/tests-js/upload-queue.test.ts b/modules/file_storage/tests-js/upload-queue.test.ts
index 31137d7bb..f7d682aad 100644
--- a/modules/file_storage/tests-js/upload-queue.test.ts
+++ b/modules/file_storage/tests-js/upload-queue.test.ts
@@ -10,7 +10,7 @@ vi.mock('@inertiajs/react', () => ({
   },
 }));
 
-import { parseFailureReason, useUploadQueue } from '../file_storage/pages/upload-queue';
+import { parseFailureReason, useUploadQueue } from '../file_storage/ui/utils/upload-queue';
 
 /** Enough XMLHttpRequest for the queue: open/send/abort plus the four events. */
 class FakeXhr {
diff --git a/modules/file_storage/tests/file_storage_uploads_helpers.py b/modules/file_storage/tests/_file_storage_uploads_support.py
similarity index 97%
rename from modules/file_storage/tests/file_storage_uploads_helpers.py
rename to modules/file_storage/tests/_file_storage_uploads_support.py
index 8b4aec651..0716b2fc4 100644
--- a/modules/file_storage/tests/file_storage_uploads_helpers.py
+++ b/modules/file_storage/tests/_file_storage_uploads_support.py
@@ -5,7 +5,7 @@
 import hashlib
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 
 API = constants.ROUTE_PREFIX_API
 MIB = constants.MIB
diff --git a/modules/file_storage/tests/file_storage_worker_helpers.py b/modules/file_storage/tests/_file_storage_worker_support.py
similarity index 100%
rename from modules/file_storage/tests/file_storage_worker_helpers.py
rename to modules/file_storage/tests/_file_storage_worker_support.py
diff --git a/modules/file_storage/tests/test_filesystem_backend.py b/modules/file_storage/tests/backends/filesystem/test_file_storage_filesystem_backend.py
similarity index 98%
rename from modules/file_storage/tests/test_filesystem_backend.py
rename to modules/file_storage/tests/backends/filesystem/test_file_storage_filesystem_backend.py
index c431c14a3..1a0bd20c1 100644
--- a/modules/file_storage/tests/test_filesystem_backend.py
+++ b/modules/file_storage/tests/backends/filesystem/test_file_storage_filesystem_backend.py
@@ -72,7 +72,7 @@ async def _drain(stream: AsyncIterator[bytes]) -> list[bytes]:
 
 
 async def test_get_range_is_inclusive_and_chunked(tmp_path):
-    from file_storage import constants
+    from file_storage.core import constants
 
     backend = FilesystemBackend(root=tmp_path)
     data = bytes(range(256)) * 1000
diff --git a/modules/file_storage/tests/test_filesystem_stale_objects.py b/modules/file_storage/tests/backends/filesystem/test_file_storage_filesystem_stale_objects.py
similarity index 97%
rename from modules/file_storage/tests/test_filesystem_stale_objects.py
rename to modules/file_storage/tests/backends/filesystem/test_file_storage_filesystem_stale_objects.py
index 5d3bb1667..fdff3e16b 100644
--- a/modules/file_storage/tests/test_filesystem_stale_objects.py
+++ b/modules/file_storage/tests/backends/filesystem/test_file_storage_filesystem_stale_objects.py
@@ -5,8 +5,8 @@
 from datetime import UTC, datetime
 from pathlib import Path
 
-from file_storage import constants
 from file_storage.backends.filesystem import FilesystemBackend
+from file_storage.core import constants
 
 
 async def test_stale_objects_skip_parts_and_walk_in_worker(tmp_path, monkeypatch):
diff --git a/modules/file_storage/tests/test_file_storage_upload_io.py b/modules/file_storage/tests/backends/filesystem/test_file_storage_upload_io.py
similarity index 100%
rename from modules/file_storage/tests/test_file_storage_upload_io.py
rename to modules/file_storage/tests/backends/filesystem/test_file_storage_upload_io.py
diff --git a/modules/file_storage/tests/test_file_storage_backend_mismatch.py b/modules/file_storage/tests/backends/registry/test_file_storage_backend_mismatch.py
similarity index 91%
rename from modules/file_storage/tests/test_file_storage_backend_mismatch.py
rename to modules/file_storage/tests/backends/registry/test_file_storage_backend_mismatch.py
index 62f64699f..c1056c000 100644
--- a/modules/file_storage/tests/test_file_storage_backend_mismatch.py
+++ b/modules/file_storage/tests/backends/registry/test_file_storage_backend_mismatch.py
@@ -6,10 +6,11 @@
 
 import pytest
 from fastapi import UploadFile
-from file_storage import constants, thumbnails
 from file_storage.backends.filesystem import FilesystemBackend
-from file_storage.service import FileStorageService
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files import thumbnails
+from file_storage.files.service import FileStorageService
 
 
 @pytest.mark.parametrize(
@@ -24,7 +25,7 @@
     ],
 )
 def test_guard_allows_missing_or_matching_identity(backend, row):
-    from file_storage.backend_guard import require_backend
+    from file_storage.backends.guard import require_backend
 
     require_backend(backend, row)
 
@@ -42,7 +43,7 @@ async def mismatched(db_session, tmp_path):
 
 @pytest.mark.parametrize("operation", ["stream", "redirect", "metadata", "thumbnail"])
 async def test_old_provider_reads_are_refused(mismatched, operation, monkeypatch):
-    from file_storage.backend_guard import BackendUnavailableError
+    from file_storage.backends.guard import BackendUnavailableError
 
     service, row = mismatched
     service.backend.get = AsyncMock(side_effect=AssertionError("wrong store"))
diff --git a/modules/file_storage/tests/test_backend_registry.py b/modules/file_storage/tests/backends/registry/test_file_storage_backend_registry.py
similarity index 95%
rename from modules/file_storage/tests/test_backend_registry.py
rename to modules/file_storage/tests/backends/registry/test_file_storage_backend_registry.py
index ece25bca4..1de12256a 100644
--- a/modules/file_storage/tests/test_backend_registry.py
+++ b/modules/file_storage/tests/backends/registry/test_file_storage_backend_registry.py
@@ -7,7 +7,6 @@
 from typing import Any
 
 import pytest
-from file_storage import constants
 from file_storage.backends import (
     build_backend,
     register_backend,
@@ -15,7 +14,8 @@
     unregister_backend,
 )
 from file_storage.contracts.service import ConfigurationError, StorageBackend
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 
 
 class _DummyBackend:
@@ -82,7 +82,7 @@ def test_unknown_backend_raises_configuration_error(tmp_path):
 
 def test_inertia_page_literal_matches_constant():
     """SM003/SM004 require a string literal in inertia.render(); guard the duplication."""
-    from file_storage.endpoints import views
+    from file_storage.web.endpoints import views
 
     text = Path(views.__file__).read_text()
     assert f'"{constants.PAGE_BROWSE}"' in text, (
diff --git a/modules/file_storage/tests/test_s3_backend.py b/modules/file_storage/tests/backends/s3/test_file_storage_s3_backend.py
similarity index 96%
rename from modules/file_storage/tests/test_s3_backend.py
rename to modules/file_storage/tests/backends/s3/test_file_storage_s3_backend.py
index ec71a57b1..003d65757 100644
--- a/modules/file_storage/tests/test_s3_backend.py
+++ b/modules/file_storage/tests/backends/s3/test_file_storage_s3_backend.py
@@ -14,10 +14,10 @@
 
 import boto3
 import pytest
-from file_storage import constants
 from file_storage.backends import build_backend
 from file_storage.contracts.service import StorageNotFoundError
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 from moto.server import ThreadedMotoServer
 
 _BUCKET = "test-bucket"
@@ -178,7 +178,7 @@ async def test_s3_presigned_url_signs_the_download_headers(s3_settings):
     """GH #489: S3 answers with these instead of the object's own metadata."""
     from urllib.parse import parse_qs, urlsplit
 
-    from file_storage.downloads import content_disposition
+    from file_storage.files.downloads import content_disposition
 
     backend = build_backend(s3_settings)
     disposition = content_disposition("Résumé 2026.pdf", attachment=True)
@@ -193,7 +193,7 @@ async def test_s3_presigned_url_signs_the_download_headers(s3_settings):
 async def test_s3_presigned_download_is_served_with_the_original_name(s3_settings):
     """End to end against moto: the signed overrides become response headers."""
     import httpx
-    from file_storage.downloads import content_disposition
+    from file_storage.files.downloads import content_disposition
 
     backend = build_backend(s3_settings)
     await _put(backend, "t/abc123", b"%PDF-1.4")
@@ -218,7 +218,7 @@ async def test_s3_signature_version_is_configurable(s3_settings):
 @pytest.mark.parametrize("value", ["s3v5", "", "v4"])
 def test_unknown_signature_version_is_rejected_at_config_time(value) -> None:
     # A typo saved in the admin UI must fail validation, not every upload.
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
     from pydantic import ValidationError
 
     with pytest.raises(ValidationError):
diff --git a/modules/file_storage/tests/conftest.py b/modules/file_storage/tests/conftest.py
index b561727a9..8714f74c2 100644
--- a/modules/file_storage/tests/conftest.py
+++ b/modules/file_storage/tests/conftest.py
@@ -14,11 +14,11 @@
 from contextlib import asynccontextmanager
 
 import pytest
+from _file_storage_uploads_support import PART
+from _file_storage_worker_support import worker_db as worker_db
 from file_storage.backends import build_backend
 from file_storage.backends.filesystem import FilesystemBackend
-from file_storage.settings import FileStorageSettings
-from file_storage_uploads_helpers import PART
-from file_storage_worker_helpers import worker_db as worker_db
+from file_storage.core.settings import FileStorageSettings
 from sqlalchemy import event
 from sqlalchemy.engine import Engine
 
@@ -177,7 +177,7 @@ async def client():
     # Tiny, hand-verifiable parts after testing settings propagation separately.
     backend.multipart_part_size_bytes = 5
     monkeypatch.setattr(
-        "file_storage.upload_support.choose_part_size", lambda size, preferred: preferred
+        "file_storage.multipart.support.choose_part_size", lambda size, preferred: preferred
     )
     return wire, backend
 
diff --git a/modules/file_storage/tests/test_format.py b/modules/file_storage/tests/core/format/test_file_storage_format.py
similarity index 95%
rename from modules/file_storage/tests/test_format.py
rename to modules/file_storage/tests/core/format/test_file_storage_format.py
index 6a43cb42d..74c02e3a9 100644
--- a/modules/file_storage/tests/test_format.py
+++ b/modules/file_storage/tests/core/format/test_file_storage_format.py
@@ -9,7 +9,7 @@
 from __future__ import annotations
 
 import pytest
-from file_storage.format import format_bytes
+from file_storage.core.format import format_bytes
 
 KIB = 1024
 MIB = KIB * KIB
diff --git a/modules/file_storage/tests/test_file_storage_menu_permission.py b/modules/file_storage/tests/core/module/test_file_storage_menu_permission.py
similarity index 90%
rename from modules/file_storage/tests/test_file_storage_menu_permission.py
rename to modules/file_storage/tests/core/module/test_file_storage_menu_permission.py
index 035062b0a..698afae30 100644
--- a/modules/file_storage/tests/test_file_storage_menu_permission.py
+++ b/modules/file_storage/tests/core/module/test_file_storage_menu_permission.py
@@ -1,7 +1,7 @@
 """Files navigation follows the browse permission, including without tenants (#698)."""
 
 import pytest
-from file_storage.constants import ROUTE_PREFIX_VIEW, Permission
+from file_storage.core.constants import ROUTE_PREFIX_VIEW, Permission
 from file_storage.module import FileStorageModule
 from simple_module_core.menu import MenuRegistry, MenuSection
 
diff --git a/modules/file_storage/tests/test_file_storage_optional_ordering.py b/modules/file_storage/tests/core/module/test_file_storage_optional_ordering.py
similarity index 100%
rename from modules/file_storage/tests/test_file_storage_optional_ordering.py
rename to modules/file_storage/tests/core/module/test_file_storage_optional_ordering.py
diff --git a/modules/file_storage/tests/test_file_storage_without_background_tasks.py b/modules/file_storage/tests/core/module/test_file_storage_without_background_tasks.py
similarity index 95%
rename from modules/file_storage/tests/test_file_storage_without_background_tasks.py
rename to modules/file_storage/tests/core/module/test_file_storage_without_background_tasks.py
index 7c63f99e9..647aab932 100644
--- a/modules/file_storage/tests/test_file_storage_without_background_tasks.py
+++ b/modules/file_storage/tests/core/module/test_file_storage_without_background_tasks.py
@@ -2,7 +2,7 @@
 
 import builtins
 
-from file_storage_uploads_helpers import API, open_session, upload_all
+from _file_storage_uploads_support import API, open_session, upload_all
 
 
 async def test_upload_without_background_tasks(app, authenticated_client, storage, monkeypatch):
diff --git a/modules/file_storage/tests/test_file_storage_quota_setting.py b/modules/file_storage/tests/core/settings/test_file_storage_quota_setting.py
similarity index 91%
rename from modules/file_storage/tests/test_file_storage_quota_setting.py
rename to modules/file_storage/tests/core/settings/test_file_storage_quota_setting.py
index a533aa053..17666d57b 100644
--- a/modules/file_storage/tests/test_file_storage_quota_setting.py
+++ b/modules/file_storage/tests/core/settings/test_file_storage_quota_setting.py
@@ -3,8 +3,8 @@
 from __future__ import annotations
 
 import pytest
-from file_storage import constants
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 from pydantic import ValidationError
 
 _API = "/api/settings/modules/file_storage"
diff --git a/modules/file_storage/tests/test_file_storage_restart_settings.py b/modules/file_storage/tests/core/settings/test_file_storage_restart_settings.py
similarity index 95%
rename from modules/file_storage/tests/test_file_storage_restart_settings.py
rename to modules/file_storage/tests/core/settings/test_file_storage_restart_settings.py
index 9989dcc59..66e9abd27 100644
--- a/modules/file_storage/tests/test_file_storage_restart_settings.py
+++ b/modules/file_storage/tests/core/settings/test_file_storage_restart_settings.py
@@ -18,7 +18,7 @@
     ],
 )
 def test_backend_construction_fields_advertise_restart(name):
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
     from settings.module_settings.discovery import _field_view
 
     field = _field_view(name, FileStorageSettings(), "SM_FILE_STORAGE_")
@@ -30,7 +30,7 @@ async def test_health_check_reads_current_backend(tmp_path):
 
     from fastapi import FastAPI
     from file_storage.backends.filesystem import FilesystemBackend
-    from file_storage.health import build_backend_check
+    from file_storage.core.health import build_backend_check
     from simple_module_core.health import HealthStatus
 
     app = FastAPI()
diff --git a/modules/file_storage/tests/test_platform_scope.py b/modules/file_storage/tests/core/tenancy/test_file_storage_platform_scope.py
similarity index 97%
rename from modules/file_storage/tests/test_platform_scope.py
rename to modules/file_storage/tests/core/tenancy/test_file_storage_platform_scope.py
index 82094abd3..c2b09d070 100644
--- a/modules/file_storage/tests/test_platform_scope.py
+++ b/modules/file_storage/tests/core/tenancy/test_file_storage_platform_scope.py
@@ -13,9 +13,9 @@
 
 import pytest
 from fastapi import UploadFile
-from file_storage import constants
+from file_storage.core import constants
+from file_storage.files.service import FileStorageService
 from file_storage.models import StoredFile
-from file_storage.service import FileStorageService
 from simple_module_db import (
     DEFAULT_TENANT_ID,
     PLATFORM_TENANT_ID,
diff --git a/modules/file_storage/tests/test_file_storage_tenancy.py b/modules/file_storage/tests/core/tenancy/test_file_storage_tenancy.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_tenancy.py
rename to modules/file_storage/tests/core/tenancy/test_file_storage_tenancy.py
index 0319c46d2..2097cc560 100644
--- a/modules/file_storage/tests/test_file_storage_tenancy.py
+++ b/modules/file_storage/tests/core/tenancy/test_file_storage_tenancy.py
@@ -10,7 +10,7 @@
 
 import httpx
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 from file_storage.models import StoredFile
 from simple_module_db import tenant_context
 from sqlalchemy import select
@@ -167,7 +167,7 @@ async def test_members_see_the_files_menu_entry(self, tenant_client):
 
 class TestCacheSlots:
     async def test_a_write_drops_only_its_own_tenants_slot(self, db_session, db_state):
-        from file_storage.aggregates import AggregateCache, register_invalidation
+        from file_storage.files.aggregates import AggregateCache, register_invalidation
 
         cache = AggregateCache()
         register_invalidation(db_state, cache)
diff --git a/modules/file_storage/tests/test_file_storage_tenancy_unbound.py b/modules/file_storage/tests/core/tenancy/test_file_storage_tenancy_unbound.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_tenancy_unbound.py
rename to modules/file_storage/tests/core/tenancy/test_file_storage_tenancy_unbound.py
index cb80d165e..c81f9a64f 100644
--- a/modules/file_storage/tests/test_file_storage_tenancy_unbound.py
+++ b/modules/file_storage/tests/core/tenancy/test_file_storage_tenancy_unbound.py
@@ -9,7 +9,7 @@
 from __future__ import annotations
 
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 from file_storage.models import StoredFile
 from simple_module_db import DEFAULT_TENANT_ID, MissingTenantError
 from simple_module_hosting.settings import Settings
@@ -77,7 +77,7 @@ async def test_upload_fails_closed_before_writing_bytes(self, app):
         from io import BytesIO
 
         from fastapi import UploadFile
-        from file_storage.service import FileStorageService
+        from file_storage.files.service import FileStorageService
 
         services = app.state.file_storage
         written: list[str] = []
@@ -99,7 +99,7 @@ async def spy_put(key, *args, **kwargs):
         assert written == []
 
     async def test_service_reads_raise_without_a_tenant(self, app):
-        from file_storage.service import FileStorageService
+        from file_storage.files.service import FileStorageService
 
         services = app.state.file_storage
         async with app.state.sm.db.session_factory() as session:
diff --git a/modules/file_storage/tests/test_file_storage_tenant_migration.py b/modules/file_storage/tests/core/tenancy/test_file_storage_tenant_migration.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_tenant_migration.py
rename to modules/file_storage/tests/core/tenancy/test_file_storage_tenant_migration.py
index 26b3c99f5..1bdb774a1 100644
--- a/modules/file_storage/tests/test_file_storage_tenant_migration.py
+++ b/modules/file_storage/tests/core/tenancy/test_file_storage_tenant_migration.py
@@ -22,7 +22,7 @@
 BEFORE = "b5d3f08a6e17"
 REVISION = "c7f2d9a41e83"
 TABLE = "file_storage_stored_file"
-SCRIPTS = Path(__file__).resolve().parents[3] / "host" / "migrations"
+SCRIPTS = Path(__file__).resolve().parents[5] / "host" / "migrations"
 
 
 @pytest.fixture
diff --git a/modules/file_storage/tests/test_file_storage_cleanup_chunks.py b/modules/file_storage/tests/core/tenant_deletion/test_file_storage_cleanup_chunks.py
similarity index 91%
rename from modules/file_storage/tests/test_file_storage_cleanup_chunks.py
rename to modules/file_storage/tests/core/tenant_deletion/test_file_storage_cleanup_chunks.py
index 353baacef..e04857d00 100644
--- a/modules/file_storage/tests/test_file_storage_cleanup_chunks.py
+++ b/modules/file_storage/tests/core/tenant_deletion/test_file_storage_cleanup_chunks.py
@@ -3,9 +3,9 @@
 from datetime import UTC, datetime
 from unittest.mock import AsyncMock
 
-from file_storage import constants
+from file_storage.core import constants
+from file_storage.core.tenant_deletion import register_tenant_deletion
 from file_storage.models import StoredFile, UploadSession
-from file_storage.tenant_deletion import register_tenant_deletion
 from simple_module_core.events import EventBus
 from simple_module_core.tenant_events import TenantDeleted
 from simple_module_db import tenant_context
@@ -13,7 +13,7 @@
 
 
 async def test_cleanup_chunks_preserve_every_entry(db_session, monkeypatch):
-    monkeypatch.setattr("file_storage.tenant_deletion.CLEANUP_BATCH_SIZE", 2)
+    monkeypatch.setattr("file_storage.core.tenant_deletion.CLEANUP_BATCH_SIZE", 2)
     bus = EventBus()
     register_tenant_deletion(bus, None)
     with tenant_context("chunked"):
diff --git a/modules/file_storage/tests/test_file_storage_tenant_deletion.py b/modules/file_storage/tests/core/tenant_deletion/test_file_storage_tenant_deletion.py
similarity index 90%
rename from modules/file_storage/tests/test_file_storage_tenant_deletion.py
rename to modules/file_storage/tests/core/tenant_deletion/test_file_storage_tenant_deletion.py
index 487ee820d..8cdb5ac5d 100644
--- a/modules/file_storage/tests/test_file_storage_tenant_deletion.py
+++ b/modules/file_storage/tests/core/tenant_deletion/test_file_storage_tenant_deletion.py
@@ -10,11 +10,11 @@
 from background_tasks.outbox_claim import OutboxPolicy
 from background_tasks.outbox_dispatch import dispatch
 from background_tasks.outbox_transport import WorkerOutboxTransport
-from file_storage import constants
 from file_storage.backends.filesystem import FilesystemBackend
+from file_storage.core import constants
+from file_storage.core.tenant_deletion import register_tenant_deletion
+from file_storage.files.thumbnails import variant_key
 from file_storage.models import StoredFile, UploadSession
-from file_storage.tenant_deletion import register_tenant_deletion
-from file_storage.thumbnails import variant_key
 from simple_module_core.events import EventBus
 from simple_module_core.invalidation import InvalidationBus
 from simple_module_core.tenant_events import TenantDeleted
@@ -30,7 +30,7 @@ async def test_tenant_cleanup_commits_manifest_and_retries(app, tmp_path, monkey
     bus.durable_transport = transport
     settings = app.state.file_storage.settings.model_copy(update={"fs_root_path": str(tmp_path)})
     backend = FilesystemBackend(tmp_path)
-    monkeypatch.setattr("file_storage.tenant_deletion.build_backend", lambda settings: backend)
+    monkeypatch.setattr("file_storage.core.tenant_deletion.build_backend", lambda settings: backend)
     register_tenant_deletion(
         bus,
         SimpleNamespace(
@@ -134,10 +134,10 @@ async def test_inline_cleanup_defers_objects_until_commit(
 
     bus = EventBus()
     backend = FilesystemBackend(tmp_path)
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
 
     settings = FileStorageSettings()
-    monkeypatch.setattr("file_storage.tenant_deletion.build_backend", lambda settings: backend)
+    monkeypatch.setattr("file_storage.core.tenant_deletion.build_backend", lambda settings: backend)
     register_tenant_deletion(
         bus,
         SimpleNamespace(
@@ -211,13 +211,15 @@ async def body():
 
 
 async def test_cleanup_skips_upload_without_backend_id(db_session, monkeypatch):
-    from file_storage.tenant_deletion import TenantStorageCleanupRequested
+    from file_storage.core.tenant_deletion import TenantStorageCleanupRequested
 
     bus = EventBus()
     backend = AsyncMock()
-    monkeypatch.setattr("file_storage.tenant_deletion.build_backend", lambda settings: backend)
+    monkeypatch.setattr("file_storage.core.tenant_deletion.build_backend", lambda settings: backend)
     register_tenant_deletion(bus, None)
-    monkeypatch.setattr("file_storage.tenant_deletion._settings", lambda app: SimpleNamespace())
+    monkeypatch.setattr(
+        "file_storage.core.tenant_deletion._settings", lambda app: SimpleNamespace()
+    )
     await bus.publish_durable_or_inline(
         TenantStorageCleanupRequested(files=[], uploads=[("pending", None), ("active", "id")]),
         db_session,
@@ -227,14 +229,14 @@ async def test_cleanup_skips_upload_without_backend_id(db_session, monkeypatch):
 
 
 async def test_cleanup_retries_transient_abort_after_all_attempts(monkeypatch):
-    from file_storage.tenant_deletion import TenantStorageCleanupRequested
+    from file_storage.core.tenant_deletion import TenantStorageCleanupRequested
 
     bus = EventBus()
     backend = AsyncMock()
     backend.abort_multipart.side_effect = [RuntimeError("offline"), None, None, None]
-    monkeypatch.setattr("file_storage.tenant_deletion.build_backend", lambda settings: backend)
+    monkeypatch.setattr("file_storage.core.tenant_deletion.build_backend", lambda settings: backend)
     monkeypatch.setattr(
-        "file_storage.tenant_deletion._settings",
+        "file_storage.core.tenant_deletion._settings",
         lambda app: SimpleNamespace(backend="filesystem", model_copy=lambda **kw: None),
     )
     register_tenant_deletion(bus, None)
diff --git a/modules/file_storage/tests/test_file_storage_object_reaper.py b/modules/file_storage/tests/core/worker/test_file_storage_object_reaper.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_object_reaper.py
rename to modules/file_storage/tests/core/worker/test_file_storage_object_reaper.py
index 4214c5bae..21817b6d6 100644
--- a/modules/file_storage/tests/test_file_storage_object_reaper.py
+++ b/modules/file_storage/tests/core/worker/test_file_storage_object_reaper.py
@@ -7,8 +7,8 @@
 
 from background_tasks import sync_db
 from file_storage import tasks
+from file_storage.core.object_reaper import reap_objects
 from file_storage.models import StoredFile
-from file_storage.object_reaper import reap_objects
 from simple_module_db import tenant_context
 from test_file_storage_upload_tasks import worker  # noqa: F401
 
diff --git a/modules/file_storage/tests/test_file_storage_upload_tasks.py b/modules/file_storage/tests/core/worker/test_file_storage_upload_tasks.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_upload_tasks.py
rename to modules/file_storage/tests/core/worker/test_file_storage_upload_tasks.py
index ba5430ca7..b9c97bb2b 100644
--- a/modules/file_storage/tests/test_file_storage_upload_tasks.py
+++ b/modules/file_storage/tests/core/worker/test_file_storage_upload_tasks.py
@@ -14,10 +14,11 @@
 
 import pytest
 from background_tasks import sync_db
-from file_storage import constants, tasks
+from file_storage import tasks
 from file_storage.backends.filesystem import FilesystemBackend
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 from file_storage.models import Base, StoredFile, UploadSession
-from file_storage.settings import FileStorageSettings
 from simple_module_db import all_tenants, tenant_context
 from sqlalchemy import create_engine, select
 
@@ -215,7 +216,7 @@ def test_the_reaper_purges_finished_rows_past_the_retention_window(worker):
 
 
 def test_checksum_refuses_previous_provider(worker, monkeypatch):
-    from file_storage.backend_guard import BackendUnavailableError
+    from file_storage.backends.guard import BackendUnavailableError
 
     file_id = uuid.uuid4()
     with tenant_context(TENANT), sync_db.sync_session() as db:
diff --git a/modules/file_storage/tests/test_file_storage_worker.py b/modules/file_storage/tests/core/worker/test_file_storage_worker.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_worker.py
rename to modules/file_storage/tests/core/worker/test_file_storage_worker.py
index c6d38f346..4c205b867 100644
--- a/modules/file_storage/tests/test_file_storage_worker.py
+++ b/modules/file_storage/tests/core/worker/test_file_storage_worker.py
@@ -6,18 +6,18 @@
 from uuid import uuid4
 
 import pytest
+from _file_storage_worker_support import set_setting
 from background_tasks import outbox_worker
 from file_storage import contracts
-from file_storage.backend_guard import BackendUnavailableError
+from file_storage.backends.guard import BackendUnavailableError
 from file_storage.contracts import FileUploaded, NotSupportedError, StoredFileOut
-from file_storage.models import StoredFile
-from file_storage.service import (
+from file_storage.files.service import (
     ContentTypeNotAllowedError,
     FileTooLargeError,
     StoredFileNotFoundError,
 )
-from file_storage.upload_support import QuotaExceededError
-from file_storage_worker_helpers import set_setting
+from file_storage.models import StoredFile
+from file_storage.multipart.support import QuotaExceededError
 from simple_module_db import tenant_context
 from simple_module_db.tenancy import TenantIsolationError
 from sqlalchemy import select
@@ -220,7 +220,7 @@ def guarded(name, *args, **kwargs):
 def test_remaining_size_lets_s3_size_parts_for_real_files(tmp_path):
     import io
 
-    from file_storage.worker import _remaining_size
+    from file_storage.core.worker import _remaining_size
 
     path = tmp_path / "out.bin"
     path.write_bytes(b"x" * 10)
diff --git a/modules/file_storage/tests/test_file_storage_worker_failures.py b/modules/file_storage/tests/core/worker/test_file_storage_worker_failures.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_worker_failures.py
rename to modules/file_storage/tests/core/worker/test_file_storage_worker_failures.py
index 5de01206c..a63297665 100644
--- a/modules/file_storage/tests/test_file_storage_worker_failures.py
+++ b/modules/file_storage/tests/core/worker/test_file_storage_worker_failures.py
@@ -5,11 +5,11 @@
 from io import BytesIO
 
 import pytest
+from _file_storage_worker_support import set_setting
 from background_tasks import outbox_worker
 from file_storage import contracts
 from file_storage.backends.filesystem import FilesystemBackend
 from file_storage.models import StoredFile
-from file_storage_worker_helpers import set_setting
 from simple_module_db import tenant_context
 from sqlalchemy import select
 from sqlalchemy.orm import Session
@@ -47,7 +47,7 @@ async def delete(*args, **kwargs):
 def test_download_failure_closes_stream_and_removes_temporary_directory(worker_db, monkeypatch):
     from tempfile import TemporaryDirectory
 
-    from file_storage import worker
+    from file_storage.core import worker
 
     directories = []
     closed = []
diff --git a/modules/file_storage/tests/test_aggregates.py b/modules/file_storage/tests/files/browse/test_file_storage_aggregates.py
similarity index 98%
rename from modules/file_storage/tests/test_aggregates.py
rename to modules/file_storage/tests/files/browse/test_file_storage_aggregates.py
index 39242f329..e29aa1c3c 100644
--- a/modules/file_storage/tests/test_aggregates.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_aggregates.py
@@ -13,8 +13,8 @@
 import uuid
 from datetime import UTC, datetime
 
-from file_storage import constants
-from file_storage.aggregates import AggregateCache, compute, register_invalidation
+from file_storage.core import constants
+from file_storage.files.aggregates import AggregateCache, compute, register_invalidation
 from file_storage.models import StoredFile
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
diff --git a/modules/file_storage/tests/test_file_storage_browse_index.py b/modules/file_storage/tests/files/browse/test_file_storage_browse_index.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_browse_index.py
rename to modules/file_storage/tests/files/browse/test_file_storage_browse_index.py
index 256842226..5ebf1d6da 100644
--- a/modules/file_storage/tests/test_file_storage_browse_index.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_browse_index.py
@@ -6,8 +6,8 @@
 import sqlalchemy as sa
 from alembic.migration import MigrationContext
 from alembic.operations import Operations
+from file_storage.files.queries import order_clauses
 from file_storage.models import StoredFile
-from file_storage.queries import order_clauses
 
 _INDEX = "ix_file_storage_stored_file_tenant_browse"
 
@@ -31,7 +31,7 @@ def test_default_browse_uses_ordered_index():
 
 def test_browse_index_migration_roundtrip():
     path = (
-        Path(__file__).resolve().parents[3]
+        Path(__file__).resolve().parents[5]
         / "host/migrations/versions/f6c2d4e8b109_file_storage_browse_index.py"
     )
     spec = importlib.util.spec_from_file_location("browse_migration", path)
diff --git a/modules/file_storage/tests/test_browse_props.py b/modules/file_storage/tests/files/browse/test_file_storage_browse_props.py
similarity index 99%
rename from modules/file_storage/tests/test_browse_props.py
rename to modules/file_storage/tests/files/browse/test_file_storage_browse_props.py
index 1d8f205e8..dabd92c43 100644
--- a/modules/file_storage/tests/test_browse_props.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_browse_props.py
@@ -9,7 +9,7 @@
 from __future__ import annotations
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 
 VIEW_BASE = f"{constants.ROUTE_PREFIX_VIEW}/"
 INERTIA_HEADERS = {"X-Inertia": "true", "Accept": "application/json"}
diff --git a/modules/file_storage/tests/test_browse_query_shape.py b/modules/file_storage/tests/files/browse/test_file_storage_browse_query_shape.py
similarity index 99%
rename from modules/file_storage/tests/test_browse_query_shape.py
rename to modules/file_storage/tests/files/browse/test_file_storage_browse_query_shape.py
index ae86b68e1..4a50e4e1c 100644
--- a/modules/file_storage/tests/test_browse_query_shape.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_browse_query_shape.py
@@ -12,7 +12,7 @@
 
 import httpx
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 
 VIEW_BASE = f"{constants.ROUTE_PREFIX_VIEW}/"
 INERTIA_HEADERS = {"X-Inertia": "true", "Accept": "application/json"}
diff --git a/modules/file_storage/tests/test_file_storage_filters.py b/modules/file_storage/tests/files/browse/test_file_storage_filters.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_filters.py
rename to modules/file_storage/tests/files/browse/test_file_storage_filters.py
index 03b0b1fd8..1ede46866 100644
--- a/modules/file_storage/tests/test_file_storage_filters.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_filters.py
@@ -11,10 +11,10 @@
 from io import BytesIO
 
 from fastapi import UploadFile
-from file_storage import constants
 from file_storage.backends.filesystem import FilesystemBackend
-from file_storage.service import FileStorageService
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files.service import FileStorageService
 from sqlalchemy.ext.asyncio import AsyncSession
 
 
diff --git a/modules/file_storage/tests/test_file_storage_uploader_directory.py b/modules/file_storage/tests/files/browse/test_file_storage_uploader_directory.py
similarity index 92%
rename from modules/file_storage/tests/test_file_storage_uploader_directory.py
rename to modules/file_storage/tests/files/browse/test_file_storage_uploader_directory.py
index e64b2e18b..5756a6ff7 100644
--- a/modules/file_storage/tests/test_file_storage_uploader_directory.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_uploader_directory.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from file_storage.resolve import label_for, resolve_uploader_labels
+from file_storage.files.resolve import label_for, resolve_uploader_labels
 from simple_module_core.user_directory import DirectoryUser, NullUserDirectory
 
 
diff --git a/modules/file_storage/tests/test_uploader_filter.py b/modules/file_storage/tests/files/browse/test_file_storage_uploader_filter.py
similarity index 96%
rename from modules/file_storage/tests/test_uploader_filter.py
rename to modules/file_storage/tests/files/browse/test_file_storage_uploader_filter.py
index 439314e9b..71f8f9d16 100644
--- a/modules/file_storage/tests/test_uploader_filter.py
+++ b/modules/file_storage/tests/files/browse/test_file_storage_uploader_filter.py
@@ -11,11 +11,11 @@
 import uuid
 
 import httpx
-from file_storage import constants
 from file_storage.backends.filesystem import FilesystemBackend
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files.service import FileStorageService
 from file_storage.models import StoredFile
-from file_storage.service import FileStorageService
-from file_storage.settings import FileStorageSettings
 from simple_module_db import tenant_context
 from sqlalchemy.ext.asyncio import AsyncSession
 
diff --git a/modules/file_storage/tests/test_bulk_delete.py b/modules/file_storage/tests/files/deletes/test_file_storage_bulk_delete.py
similarity index 97%
rename from modules/file_storage/tests/test_bulk_delete.py
rename to modules/file_storage/tests/files/deletes/test_file_storage_bulk_delete.py
index c6ce663bb..55fe445fd 100644
--- a/modules/file_storage/tests/test_bulk_delete.py
+++ b/modules/file_storage/tests/files/deletes/test_file_storage_bulk_delete.py
@@ -13,8 +13,8 @@
 
 import httpx
 from fastapi import UploadFile
-from file_storage import constants
 from file_storage.contracts.events import FileDeleted
+from file_storage.core import constants
 
 BULK_DELETE = f"{constants.ROUTE_PREFIX_API}{constants.PATH_FILES_BULK_DELETE}"
 LIST_FILES = f"{constants.ROUTE_PREFIX_API}{constants.PATH_FILES}"
@@ -111,8 +111,8 @@ async def test_one_unreachable_object_does_not_abort_the_batch(self, tmp_path, d
         Letting one unreachable object raise would 500 the request, tell the
         caller nothing happened, and leave the rest behind as orphans."""
         from file_storage.backends.filesystem import FilesystemBackend
-        from file_storage.service import FileStorageService
-        from file_storage.settings import FileStorageSettings
+        from file_storage.core.settings import FileStorageSettings
+        from file_storage.files.service import FileStorageService
 
         class OneBadKey(FilesystemBackend):
             async def delete(self, key: str) -> None:
diff --git a/modules/file_storage/tests/test_delete_permission_modes.py b/modules/file_storage/tests/files/deletes/test_file_storage_delete_permission_modes.py
similarity index 93%
rename from modules/file_storage/tests/test_delete_permission_modes.py
rename to modules/file_storage/tests/files/deletes/test_file_storage_delete_permission_modes.py
index bbe16553b..2d6c11a0d 100644
--- a/modules/file_storage/tests/test_delete_permission_modes.py
+++ b/modules/file_storage/tests/files/deletes/test_file_storage_delete_permission_modes.py
@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import pytest
-from file_storage.constants import Permission
+from file_storage.core.constants import Permission
 from simple_module_hosting.settings import Settings
 
 
diff --git a/modules/file_storage/tests/test_file_storage_media_types.py b/modules/file_storage/tests/files/media/test_file_storage_media_types.py
similarity index 95%
rename from modules/file_storage/tests/test_file_storage_media_types.py
rename to modules/file_storage/tests/files/media/test_file_storage_media_types.py
index 070da9ca0..0ab38adff 100644
--- a/modules/file_storage/tests/test_file_storage_media_types.py
+++ b/modules/file_storage/tests/files/media/test_file_storage_media_types.py
@@ -3,8 +3,8 @@
 from __future__ import annotations
 
 import pytest
-from file_storage import constants
-from file_storage.media_types import is_active_content, normalise_media_type
+from file_storage.core import constants
+from file_storage.files.media_types import is_active_content, normalise_media_type
 
 API = constants.ROUTE_PREFIX_API
 
diff --git a/modules/file_storage/tests/test_file_storage_range_parse.py b/modules/file_storage/tests/files/media/test_file_storage_range_parse.py
similarity index 94%
rename from modules/file_storage/tests/test_file_storage_range_parse.py
rename to modules/file_storage/tests/files/media/test_file_storage_range_parse.py
index 4bd4c302d..6662167a2 100644
--- a/modules/file_storage/tests/test_file_storage_range_parse.py
+++ b/modules/file_storage/tests/files/media/test_file_storage_range_parse.py
@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import pytest
-from file_storage.ranges import UNSATISFIABLE, ByteRange, parse_range
+from file_storage.files.ranges import UNSATISFIABLE, ByteRange, parse_range
 
 SIZE = 1000
 
@@ -67,7 +67,7 @@ async def test_416_is_not_cacheable() -> None:
     from types import SimpleNamespace
     from unittest.mock import MagicMock
 
-    from file_storage.ranges import file_body_response
+    from file_storage.files.ranges import file_body_response
     from starlette.requests import Request
 
     request = Request(
diff --git a/modules/file_storage/tests/test_file_storage_thumbnail_hardening.py b/modules/file_storage/tests/files/media/test_file_storage_thumbnail_hardening.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_thumbnail_hardening.py
rename to modules/file_storage/tests/files/media/test_file_storage_thumbnail_hardening.py
index 5ff5fd55d..8f7f166e8 100644
--- a/modules/file_storage/tests/test_file_storage_thumbnail_hardening.py
+++ b/modules/file_storage/tests/files/media/test_file_storage_thumbnail_hardening.py
@@ -8,7 +8,8 @@
 from uuid import uuid4
 
 import pytest
-from file_storage import constants, thumbnails
+from file_storage.core import constants
+from file_storage.files import thumbnails
 from PIL import Image
 from simple_module_test import wait_for
 
diff --git a/modules/file_storage/tests/test_file_storage_thumbnail_session_release.py b/modules/file_storage/tests/files/media/test_file_storage_thumbnail_session_release.py
similarity index 94%
rename from modules/file_storage/tests/test_file_storage_thumbnail_session_release.py
rename to modules/file_storage/tests/files/media/test_file_storage_thumbnail_session_release.py
index 85993f89d..45db4f245 100644
--- a/modules/file_storage/tests/test_file_storage_thumbnail_session_release.py
+++ b/modules/file_storage/tests/files/media/test_file_storage_thumbnail_session_release.py
@@ -11,8 +11,9 @@
 import io
 
 import pytest
-from file_storage import constants, thumbnails
-from file_storage.visibility import FileStoragePublic
+from file_storage.core import constants
+from file_storage.files import thumbnails
+from file_storage.files.visibility import FileStoragePublic
 from PIL import Image
 
 API = constants.ROUTE_PREFIX_API
diff --git a/modules/file_storage/tests/test_file_storage_thumbnails.py b/modules/file_storage/tests/files/media/test_file_storage_thumbnails.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_thumbnails.py
rename to modules/file_storage/tests/files/media/test_file_storage_thumbnails.py
index c70c2ca5a..df254d9af 100644
--- a/modules/file_storage/tests/test_file_storage_thumbnails.py
+++ b/modules/file_storage/tests/files/media/test_file_storage_thumbnails.py
@@ -4,7 +4,8 @@
 
 import io
 
-from file_storage import constants, thumbnails
+from file_storage.core import constants
+from file_storage.files import thumbnails
 from PIL import Image
 
 API = constants.ROUTE_PREFIX_API
diff --git a/modules/file_storage/tests/test_file_storage_commit_cleanup.py b/modules/file_storage/tests/files/service/test_file_storage_commit_cleanup.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_commit_cleanup.py
rename to modules/file_storage/tests/files/service/test_file_storage_commit_cleanup.py
index 5bcee5db9..277237cbb 100644
--- a/modules/file_storage/tests/test_file_storage_commit_cleanup.py
+++ b/modules/file_storage/tests/files/service/test_file_storage_commit_cleanup.py
@@ -3,7 +3,7 @@
 from unittest.mock import AsyncMock
 
 import pytest
-from file_storage import thumbnails
+from file_storage.files import thumbnails
 from simple_module_db.session import RequestSession
 
 
diff --git a/modules/file_storage/tests/test_file_storage_delete_variants.py b/modules/file_storage/tests/files/service/test_file_storage_delete_variants.py
similarity index 90%
rename from modules/file_storage/tests/test_file_storage_delete_variants.py
rename to modules/file_storage/tests/files/service/test_file_storage_delete_variants.py
index 26bc24fbe..1923fbcf0 100644
--- a/modules/file_storage/tests/test_file_storage_delete_variants.py
+++ b/modules/file_storage/tests/files/service/test_file_storage_delete_variants.py
@@ -6,10 +6,11 @@
 
 import pytest
 from fastapi import UploadFile
-from file_storage import constants, thumbnails
 from file_storage.backends.filesystem import FilesystemBackend
-from file_storage.service import FileStorageService
-from file_storage.settings import FileStorageSettings
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files import thumbnails
+from file_storage.files.service import FileStorageService
 
 
 class BrokenOriginals(FilesystemBackend):
diff --git a/modules/file_storage/tests/test_file_storage_owner_scope.py b/modules/file_storage/tests/files/service/test_file_storage_owner_scope.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_owner_scope.py
rename to modules/file_storage/tests/files/service/test_file_storage_owner_scope.py
index 9ec1a9b5d..1abf4f95c 100644
--- a/modules/file_storage/tests/test_file_storage_owner_scope.py
+++ b/modules/file_storage/tests/files/service/test_file_storage_owner_scope.py
@@ -11,8 +11,8 @@
 
 import httpx
 import pytest
-from file_storage import constants
-from file_storage_uploads_helpers import API, INERTIA, upload_text
+from _file_storage_uploads_support import API, INERTIA, upload_text
+from file_storage.core import constants
 from simple_module_hosting.settings import Settings
 from simple_module_test.tenant_client import create_user, session_client
 
diff --git a/modules/file_storage/tests/test_service.py b/modules/file_storage/tests/files/service/test_file_storage_service.py
similarity index 98%
rename from modules/file_storage/tests/test_service.py
rename to modules/file_storage/tests/files/service/test_file_storage_service.py
index 1ec706352..188b5e58a 100644
--- a/modules/file_storage/tests/test_service.py
+++ b/modules/file_storage/tests/files/service/test_file_storage_service.py
@@ -10,11 +10,11 @@
 import pytest
 from _pytest.monkeypatch import MonkeyPatch
 from fastapi import UploadFile
-from file_storage import constants
 from file_storage.backends.filesystem import FilesystemBackend
 from file_storage.contracts.service import StorageBackend
-from file_storage.models import StoredFile
-from file_storage.service import (
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files.service import (
     ContentTypeNotAllowedError,
     FileStorageService,
     FileTooLargeError,
@@ -22,7 +22,7 @@
     StoredFileNotFoundError,
     StreamDownload,
 )
-from file_storage.settings import FileStorageSettings
+from file_storage.models import StoredFile
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
diff --git a/modules/file_storage/tests/test_file_storage_timestamps.py b/modules/file_storage/tests/files/service/test_file_storage_timestamps.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_timestamps.py
rename to modules/file_storage/tests/files/service/test_file_storage_timestamps.py
index 047cddffc..f924acf64 100644
--- a/modules/file_storage/tests/test_file_storage_timestamps.py
+++ b/modules/file_storage/tests/files/service/test_file_storage_timestamps.py
@@ -9,7 +9,7 @@
 from datetime import UTC, datetime, timedelta
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 
 
 def _assert_utc(stamp: str) -> None:
diff --git a/modules/file_storage/tests/test_file_storage_checksum_reconciliation.py b/modules/file_storage/tests/multipart/guards/test_file_storage_checksum_reconciliation.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_checksum_reconciliation.py
rename to modules/file_storage/tests/multipart/guards/test_file_storage_checksum_reconciliation.py
index 9e7a89da8..17c55abde 100644
--- a/modules/file_storage/tests/test_file_storage_checksum_reconciliation.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_checksum_reconciliation.py
@@ -5,7 +5,8 @@
 
 import pytest
 from background_tasks import sync_db
-from file_storage import constants, tasks
+from file_storage import tasks
+from file_storage.core import constants
 from file_storage.models import Base, StoredFile
 from simple_module_db import tenant_context
 from simple_module_db.tenancy import current_tenant_id
diff --git a/modules/file_storage/tests/test_file_storage_p3_scope_usage.py b/modules/file_storage/tests/multipart/guards/test_file_storage_p3_scope_usage.py
similarity index 94%
rename from modules/file_storage/tests/test_file_storage_p3_scope_usage.py
rename to modules/file_storage/tests/multipart/guards/test_file_storage_p3_scope_usage.py
index 9509f8334..19951678c 100644
--- a/modules/file_storage/tests/test_file_storage_p3_scope_usage.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_p3_scope_usage.py
@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-from file_storage import constants
-from file_storage_uploads_helpers import API, INERTIA, upload_text
+from _file_storage_uploads_support import API, INERTIA, upload_text
+from file_storage.core import constants
 
 VIEW = f"{constants.ROUTE_PREFIX_VIEW}/"
 
diff --git a/modules/file_storage/tests/test_file_storage_plain_quota.py b/modules/file_storage/tests/multipart/guards/test_file_storage_plain_quota.py
similarity index 88%
rename from modules/file_storage/tests/test_file_storage_plain_quota.py
rename to modules/file_storage/tests/multipart/guards/test_file_storage_plain_quota.py
index 1a09a59a5..87cf7086d 100644
--- a/modules/file_storage/tests/test_file_storage_plain_quota.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_plain_quota.py
@@ -1,7 +1,7 @@
 """Plain uploads share stored-byte limits and resumable reservations (#586)."""
 
-from file_storage import constants
-from file_storage_uploads_helpers import API, open_session
+from _file_storage_uploads_support import API, open_session
+from file_storage.core import constants
 
 
 async def upload(client, size):
@@ -40,9 +40,9 @@ async def test_platform_quota_counts_only_platform_files(db_session, tmp_path):
     import pytest
     from fastapi import UploadFile
     from file_storage.backends.filesystem import FilesystemBackend
-    from file_storage.service import FileStorageService
-    from file_storage.settings import FileStorageSettings
-    from file_storage.upload_support import QuotaExceededError
+    from file_storage.core.settings import FileStorageSettings
+    from file_storage.files.service import FileStorageService
+    from file_storage.multipart.support import QuotaExceededError
     from simple_module_db import tenant_context
 
     backend = FilesystemBackend(root=tmp_path)
diff --git a/modules/file_storage/tests/test_file_storage_server_put.py b/modules/file_storage/tests/multipart/guards/test_file_storage_server_put.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_server_put.py
rename to modules/file_storage/tests/multipart/guards/test_file_storage_server_put.py
index 71ab7559b..021d1a98c 100644
--- a/modules/file_storage/tests/test_file_storage_server_put.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_server_put.py
@@ -3,10 +3,10 @@
 import asyncio
 
 import pytest
-from file_storage import constants
 from file_storage.backends import build_backend
-from file_storage.settings import FileStorageSettings
-from file_storage.upload_support import SizeMismatchError
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.multipart.support import SizeMismatchError
 
 
 @pytest.mark.parametrize(
diff --git a/modules/file_storage/tests/test_upload_failure_modes.py b/modules/file_storage/tests/multipart/guards/test_file_storage_upload_failure_modes.py
similarity index 95%
rename from modules/file_storage/tests/test_upload_failure_modes.py
rename to modules/file_storage/tests/multipart/guards/test_file_storage_upload_failure_modes.py
index d6cc9445f..efdc1e4e2 100644
--- a/modules/file_storage/tests/test_upload_failure_modes.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_upload_failure_modes.py
@@ -16,11 +16,11 @@
 
 import pytest
 from fastapi import UploadFile
-from file_storage import constants
 from file_storage.backends.filesystem import FilesystemBackend
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files.service import FileStorageService
 from file_storage.models import StoredFile
-from file_storage.service import FileStorageService
-from file_storage.settings import FileStorageSettings
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -118,7 +118,7 @@ async def test_oversize_upload_does_not_create_db_row(tmp_path, db_session: Asyn
         _settings(tmp_path, max_file_size_bytes=4),
     )
 
-    from file_storage.service import FileTooLargeError
+    from file_storage.files.service import FileTooLargeError
 
     with pytest.raises(FileTooLargeError):
         await svc.upload(_upload("too-big.bin", b"way too large"))
diff --git a/modules/file_storage/tests/test_file_storage_upload_guards.py b/modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_upload_guards.py
rename to modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py
index 5e0bd8bd3..37f242bdb 100644
--- a/modules/file_storage/tests/test_file_storage_upload_guards.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py
@@ -8,12 +8,12 @@
 from typing import Any
 
 import pytest
-from file_storage import constants
-from file_storage import upload_guards as guards_module
 from file_storage.contracts.service import StorageError
+from file_storage.core import constants
 from file_storage.models import StoredFile, UploadSession
-from file_storage.upload_guards import UploadGuards
-from file_storage.upload_support import DirectUploadUnsupportedError, QuotaExceededError
+from file_storage.multipart import guards as guards_module
+from file_storage.multipart.guards import UploadGuards
+from file_storage.multipart.support import DirectUploadUnsupportedError, QuotaExceededError
 from simple_module_db import tenant_context
 from sqlalchemy import select
 
diff --git a/modules/file_storage/tests/test_file_storage_busy_admission.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_busy_admission.py
similarity index 85%
rename from modules/file_storage/tests/test_file_storage_busy_admission.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_busy_admission.py
index eaa033054..3308482ea 100644
--- a/modules/file_storage/tests/test_file_storage_busy_admission.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_busy_admission.py
@@ -1,7 +1,8 @@
 """A contended SQLite quota lock is a retryable 409, not "quota exceeded" (#753)."""
 
-from file_storage import constants, upload_guards
-from file_storage_uploads_helpers import API, open_session
+from _file_storage_uploads_support import API, open_session
+from file_storage.core import constants
+from file_storage.multipart import guards as upload_guards
 
 
 async def _busy(_db, _table, *, on_busy):
diff --git a/modules/file_storage/tests/test_file_storage_sqlite_admission_race.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_sqlite_admission_race.py
similarity index 93%
rename from modules/file_storage/tests/test_file_storage_sqlite_admission_race.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_sqlite_admission_race.py
index 852c4edc0..f89797f02 100644
--- a/modules/file_storage/tests/test_file_storage_sqlite_admission_race.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_sqlite_admission_race.py
@@ -7,11 +7,11 @@
 import pytest
 from fastapi import UploadFile
 from file_storage.backends.filesystem import FilesystemBackend
+from file_storage.core.settings import FileStorageSettings
+from file_storage.files.service import FileStorageService
 from file_storage.models import Base, StoredFile, UploadSession
-from file_storage.service import FileStorageService
-from file_storage.settings import FileStorageSettings
-from file_storage.upload_support import QuotaExceededError, StorageBusyError
-from file_storage.uploads import UploadSessionService
+from file_storage.multipart.sessions import UploadSessionService
+from file_storage.multipart.support import QuotaExceededError, StorageBusyError
 from simple_module_db import tenant_context
 from simple_module_db.listeners import register_listeners
 from simple_module_db.session import init_db
diff --git a/modules/file_storage/tests/test_file_storage_uploads_expiry.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_expiry.py
similarity index 95%
rename from modules/file_storage/tests/test_file_storage_uploads_expiry.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_expiry.py
index 65bcd2e80..e0b1257e0 100644
--- a/modules/file_storage/tests/test_file_storage_uploads_expiry.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_expiry.py
@@ -6,9 +6,9 @@
 from datetime import UTC, datetime, timedelta
 
 import pytest
-from file_storage import constants
+from _file_storage_uploads_support import API, PART, open_session
+from file_storage.core import constants
 from file_storage.models import UploadSession
-from file_storage_uploads_helpers import API, PART, open_session
 from simple_module_db import all_tenants
 from sqlalchemy import select, update
 
diff --git a/modules/file_storage/tests/test_file_storage_uploads_fs.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_fs.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_uploads_fs.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_fs.py
index 3e5394962..31f293d74 100644
--- a/modules/file_storage/tests/test_file_storage_uploads_fs.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_fs.py
@@ -6,10 +6,18 @@
 from datetime import UTC, datetime, timedelta
 
 import pytest
-from file_storage import constants
+from _file_storage_uploads_support import (
+    API,
+    MIB,
+    PART,
+    open_session,
+    payload,
+    put_part,
+    upload_all,
+)
 from file_storage.contracts.events import FileUploaded
+from file_storage.core import constants
 from file_storage.models import StoredFile, UploadSession
-from file_storage_uploads_helpers import API, MIB, PART, open_session, payload, put_part, upload_all
 from simple_module_db import all_tenants, tenant_context
 from sqlalchemy import select, update
 
@@ -253,7 +261,7 @@ async def test_the_file_belongs_to_the_owners_tenant(self, app, tenant_client, s
 def test_no_checksum_task_without_background_tasks(checksum_calls):
     from types import SimpleNamespace
 
-    from file_storage.checksum import schedule_checksum
+    from file_storage.multipart.checksum import schedule_checksum
 
     file_id = uuid.uuid4()
     bare = SimpleNamespace(state=SimpleNamespace())
diff --git a/modules/file_storage/tests/test_file_storage_uploads_minio.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
similarity index 94%
rename from modules/file_storage/tests/test_file_storage_uploads_minio.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
index 9d547da9b..57750c92d 100644
--- a/modules/file_storage/tests/test_file_storage_uploads_minio.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
@@ -18,10 +18,10 @@
 import boto3
 import httpx
 import pytest
-from file_storage import constants
+from _file_storage_uploads_support import MIB
 from file_storage.backends import build_backend
-from file_storage.settings import FileStorageSettings
-from file_storage_uploads_helpers import MIB
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
 
 ENDPOINT = os.environ.get("SM_TEST_S3_ENDPOINT")
 BUCKET = "sm-multipart-test"
diff --git a/modules/file_storage/tests/test_file_storage_uploads_pg.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_pg.py
similarity index 95%
rename from modules/file_storage/tests/test_file_storage_uploads_pg.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_pg.py
index 2ffd2a5a2..c7a235f31 100644
--- a/modules/file_storage/tests/test_file_storage_uploads_pg.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_pg.py
@@ -11,8 +11,8 @@
 import os
 
 import pytest
-from file_storage import constants
-from file_storage_uploads_helpers import API, PART, open_session, payload, upload_all
+from _file_storage_uploads_support import API, PART, open_session, payload, upload_all
+from file_storage.core import constants
 
 pytestmark = [
     pytest.mark.usefixtures("checksum_calls"),
diff --git a/modules/file_storage/tests/test_file_storage_uploads_quota.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_quota.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_uploads_quota.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_quota.py
index 64b70f251..6f8b05abe 100644
--- a/modules/file_storage/tests/test_file_storage_uploads_quota.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_quota.py
@@ -3,8 +3,8 @@
 from __future__ import annotations
 
 import pytest
-from file_storage import constants
-from file_storage_uploads_helpers import API, PART, open_session, payload, upload_all
+from _file_storage_uploads_support import API, PART, open_session, payload, upload_all
+from file_storage.core import constants
 
 pytestmark = pytest.mark.usefixtures("checksum_calls")
 
diff --git a/modules/file_storage/tests/test_file_storage_uploads_s3.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_s3.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_uploads_s3.py
rename to modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_s3.py
index 6d64e7789..241972643 100644
--- a/modules/file_storage/tests/test_file_storage_uploads_s3.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_s3.py
@@ -14,12 +14,12 @@
 import boto3
 import httpx
 import pytest
-from file_storage import constants
+from _file_storage_uploads_support import API, MIB, open_session
 from file_storage.backends import build_backend
 from file_storage.contracts.service import Part, StorageNotFoundError
-from file_storage.csp import s3_connect_origins
-from file_storage.settings import FileStorageSettings
-from file_storage_uploads_helpers import API, MIB, open_session
+from file_storage.core import constants
+from file_storage.core.settings import FileStorageSettings
+from file_storage.web.csp import s3_connect_origins
 from moto.server import ThreadedMotoServer
 
 _BUCKET = "mp-test-bucket"
diff --git a/modules/file_storage/tests/test_api.py b/modules/file_storage/tests/web/api/test_file_storage_api.py
similarity index 99%
rename from modules/file_storage/tests/test_api.py
rename to modules/file_storage/tests/web/api/test_file_storage_api.py
index dcfff4f99..859b641d3 100644
--- a/modules/file_storage/tests/test_api.py
+++ b/modules/file_storage/tests/web/api/test_file_storage_api.py
@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 
 
 async def test_upload_then_list(authenticated_client: httpx.AsyncClient):
diff --git a/modules/file_storage/tests/test_file_storage_deps_backend.py b/modules/file_storage/tests/web/api/test_file_storage_deps_backend.py
similarity index 73%
rename from modules/file_storage/tests/test_file_storage_deps_backend.py
rename to modules/file_storage/tests/web/api/test_file_storage_deps_backend.py
index d5bdba4d7..cc97ab4d7 100644
--- a/modules/file_storage/tests/test_file_storage_deps_backend.py
+++ b/modules/file_storage/tests/web/api/test_file_storage_deps_backend.py
@@ -1,8 +1,8 @@
 """``get_file_storage_service`` refuses to run before the backend is built."""
 
 import pytest
-from file_storage.deps import get_file_storage_service
-from file_storage.services import FileStorageServices
+from file_storage.core.services import FileStorageServices
+from file_storage.web.deps import get_file_storage_service
 
 
 async def test_service_dep_requires_backend():
diff --git a/modules/file_storage/tests/test_files_api_pagination_bounds.py b/modules/file_storage/tests/web/api/test_file_storage_files_api_pagination_bounds.py
similarity index 94%
rename from modules/file_storage/tests/test_files_api_pagination_bounds.py
rename to modules/file_storage/tests/web/api/test_file_storage_files_api_pagination_bounds.py
index da0e91af7..ca8d58bf2 100644
--- a/modules/file_storage/tests/test_files_api_pagination_bounds.py
+++ b/modules/file_storage/tests/web/api/test_file_storage_files_api_pagination_bounds.py
@@ -4,7 +4,7 @@
 
 import httpx
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
 
 LIST_FILES = f"{constants.ROUTE_PREFIX_API}{constants.PATH_FILES}"
diff --git a/modules/file_storage/tests/test_file_storage_page_clamp.py b/modules/file_storage/tests/web/api/test_file_storage_page_clamp.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_page_clamp.py
rename to modules/file_storage/tests/web/api/test_file_storage_page_clamp.py
index d13a9f3c2..36196f74b 100644
--- a/modules/file_storage/tests/test_file_storage_page_clamp.py
+++ b/modules/file_storage/tests/web/api/test_file_storage_page_clamp.py
@@ -11,7 +11,7 @@
 
 import httpx
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 
 VIEW_BASE = f"{constants.ROUTE_PREFIX_VIEW}/"
 INERTIA_HEADERS = {"X-Inertia": "true", "Accept": "application/json"}
diff --git a/modules/file_storage/tests/test_file_storage_deleted_tenant_public.py b/modules/file_storage/tests/web/public/test_file_storage_deleted_tenant_public.py
similarity index 89%
rename from modules/file_storage/tests/test_file_storage_deleted_tenant_public.py
rename to modules/file_storage/tests/web/public/test_file_storage_deleted_tenant_public.py
index 0cab5eb1e..d8cd2303f 100644
--- a/modules/file_storage/tests/test_file_storage_deleted_tenant_public.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_deleted_tenant_public.py
@@ -3,7 +3,7 @@
 import io
 
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 from PIL import Image
 from simple_module_core.tenant_events import TENANT_DELETED_CHANNEL
 from sqlalchemy import delete
@@ -28,7 +28,7 @@ async def test_file_storage_public_checks_deleted_tenant(
         f"{constants.ROUTE_PREFIX_API}/public/{file['id']}",
         f"{constants.ROUTE_PREFIX_API}/public/{file['id']}/thumbnail?w=64",
     ]
-    from file_storage.service import FileStorageService
+    from file_storage.files.service import FileStorageService
 
     original_get_public = FileStorageService.get_public
     original_lookup = app.state.tenant_exists
@@ -46,7 +46,7 @@ async def lookup(tenant_id):
 
     monkeypatch.setattr(FileStorageService, "get_public", get_public)
     monkeypatch.setattr(app.state, "tenant_exists", lookup)
-    monkeypatch.setattr("file_storage.tenant_cache.TENANT_EXISTS_TTL_SECONDS", 0)
+    monkeypatch.setattr("file_storage.core.tenant_cache.TENANT_EXISTS_TTL_SECONDS", 0)
     for url in urls:
         assert (await client.get(url)).status_code == 200
         assert not request_sessions[-1].in_transaction()
@@ -60,7 +60,7 @@ async def lookup(tenant_id):
         await db.commit()
 
     # A missed event is bounded by the TTL; expire the previously cached answer.
-    monkeypatch.setattr("file_storage.tenant_cache.TENANT_EXISTS_TTL_SECONDS", 0)
+    monkeypatch.setattr("file_storage.core.tenant_cache.TENANT_EXISTS_TTL_SECONDS", 0)
     if not directory:
         # Hosts without a tenant registry retain the single-tenant contract.
         monkeypatch.delattr(app.state, "tenant_exists")
@@ -73,7 +73,7 @@ async def test_tenant_existence_cache_hit_invalidation_and_ttl(monkeypatch):
     from unittest.mock import AsyncMock
 
     from fastapi import FastAPI
-    from file_storage.tenant_cache import cached_tenant_exists
+    from file_storage.core.tenant_cache import cached_tenant_exists
     from simple_module_core.invalidation import InvalidationBus
 
     app = FastAPI()
@@ -90,6 +90,6 @@ async def test_tenant_existence_cache_hit_invalidation_and_ttl(monkeypatch):
     await bus.publish(TENANT_DELETED_CHANNEL, key="tenant")
     assert await cached_tenant_exists(app, "tenant") is False
     assert lookup.await_count == 2
-    monkeypatch.setattr("file_storage.tenant_cache.TENANT_EXISTS_TTL_SECONDS", 0)
+    monkeypatch.setattr("file_storage.core.tenant_cache.TENANT_EXISTS_TTL_SECONDS", 0)
     assert await cached_tenant_exists(app, "tenant") is False
     assert lookup.await_count == 3
diff --git a/modules/file_storage/tests/test_file_storage_p3_download_csp.py b/modules/file_storage/tests/web/public/test_file_storage_p3_download_csp.py
similarity index 92%
rename from modules/file_storage/tests/test_file_storage_p3_download_csp.py
rename to modules/file_storage/tests/web/public/test_file_storage_p3_download_csp.py
index 1cb7949f8..167a8f704 100644
--- a/modules/file_storage/tests/test_file_storage_p3_download_csp.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_p3_download_csp.py
@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-from file_storage import constants
-from file_storage_uploads_helpers import API, upload_text
+from _file_storage_uploads_support import API, upload_text
+from file_storage.core import constants
 
 
 class TestDownloadSandbox:
diff --git a/modules/file_storage/tests/test_file_storage_public.py b/modules/file_storage/tests/web/public/test_file_storage_public.py
similarity index 99%
rename from modules/file_storage/tests/test_file_storage_public.py
rename to modules/file_storage/tests/web/public/test_file_storage_public.py
index 25bc3160c..bd30ab23b 100644
--- a/modules/file_storage/tests/test_file_storage_public.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_public.py
@@ -5,7 +5,7 @@
 import uuid
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 
 API = constants.ROUTE_PREFIX_API
 
diff --git a/modules/file_storage/tests/test_file_storage_public_cookieless.py b/modules/file_storage/tests/web/public/test_file_storage_public_cookieless.py
similarity index 98%
rename from modules/file_storage/tests/test_file_storage_public_cookieless.py
rename to modules/file_storage/tests/web/public/test_file_storage_public_cookieless.py
index 35ac84545..f008ce404 100644
--- a/modules/file_storage/tests/test_file_storage_public_cookieless.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_public_cookieless.py
@@ -11,7 +11,7 @@
 import io
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 from PIL import Image
 
 API = constants.ROUTE_PREFIX_API
diff --git a/modules/file_storage/tests/test_file_storage_public_cors.py b/modules/file_storage/tests/web/public/test_file_storage_public_cors.py
similarity index 97%
rename from modules/file_storage/tests/test_file_storage_public_cors.py
rename to modules/file_storage/tests/web/public/test_file_storage_public_cors.py
index c9f29e5c4..1bf0b0728 100644
--- a/modules/file_storage/tests/test_file_storage_public_cors.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_public_cors.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from file_storage import constants
+from file_storage.core import constants
 
 API = constants.ROUTE_PREFIX_API
 ORIGIN = "https://site.example.org"
diff --git a/modules/file_storage/tests/test_file_storage_public_rate.py b/modules/file_storage/tests/web/public/test_file_storage_public_rate.py
similarity index 91%
rename from modules/file_storage/tests/test_file_storage_public_rate.py
rename to modules/file_storage/tests/web/public/test_file_storage_public_rate.py
index 74744ea9a..1b848310b 100644
--- a/modules/file_storage/tests/test_file_storage_public_rate.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_public_rate.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from file_storage import constants
+from file_storage.core import constants
 
 
 async def test_file_storage_public_route_has_its_own_rate(app) -> None:
diff --git a/modules/file_storage/tests/test_file_storage_range_download.py b/modules/file_storage/tests/web/public/test_file_storage_range_download.py
similarity index 99%
rename from modules/file_storage/tests/test_file_storage_range_download.py
rename to modules/file_storage/tests/web/public/test_file_storage_range_download.py
index 77696c918..da3a97d25 100644
--- a/modules/file_storage/tests/test_file_storage_range_download.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_range_download.py
@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import httpx
-from file_storage import constants
+from file_storage.core import constants
 
 API = constants.ROUTE_PREFIX_API
 PAYLOAD = bytes(range(256)) * 800  # 204,800 bytes: several 64 KiB chunks
diff --git a/modules/file_storage/tests/test_file_storage_single_tenant_public.py b/modules/file_storage/tests/web/public/test_file_storage_single_tenant_public.py
similarity index 96%
rename from modules/file_storage/tests/test_file_storage_single_tenant_public.py
rename to modules/file_storage/tests/web/public/test_file_storage_single_tenant_public.py
index 293ab8d8a..80e6bcb30 100644
--- a/modules/file_storage/tests/test_file_storage_single_tenant_public.py
+++ b/modules/file_storage/tests/web/public/test_file_storage_single_tenant_public.py
@@ -3,7 +3,7 @@
 import io
 
 import pytest
-from file_storage import constants
+from file_storage.core import constants
 from PIL import Image
 from simple_module_hosting.settings import Settings
 
diff --git a/modules/settings/tests/module_settings/fields/test_settings_field_sources.py b/modules/settings/tests/module_settings/fields/test_settings_field_sources.py
index 2e1ee1b64..46f8b63bf 100644
--- a/modules/settings/tests/module_settings/fields/test_settings_field_sources.py
+++ b/modules/settings/tests/module_settings/fields/test_settings_field_sources.py
@@ -80,7 +80,7 @@ def test_unread_env_var_is_not_claimed_as_the_source(self, monkeypatch: pytest.M
         """Module settings declare no ``env_prefix`` — they come from defaults
         plus DB overrides — so a leftover ``SM_*`` var changes nothing. Badging
         it "From environment" would invert the question this screen answers."""
-        from file_storage.settings import FileStorageSettings
+        from file_storage.core.settings import FileStorageSettings
         from settings.module_settings.discovery import _field_view
 
         name = _first_field(FileStorageSettings())
@@ -92,7 +92,7 @@ def test_unread_env_var_is_not_claimed_as_the_source(self, monkeypatch: pytest.M
         assert _field_view(name, instance, "SM_FILE_STORAGE_").source == "default"
 
     def test_overrides_mark_their_fields(self):
-        from file_storage.settings import FileStorageSettings
+        from file_storage.core.settings import FileStorageSettings
         from settings.module_settings.discovery import _field_view
 
         instance = FileStorageSettings()
diff --git a/modules/settings/tests/module_settings/fields/test_settings_lenient_related_fields_validators.py b/modules/settings/tests/module_settings/fields/test_settings_lenient_related_fields_validators.py
index 31703de78..6341b5719 100644
--- a/modules/settings/tests/module_settings/fields/test_settings_lenient_related_fields_validators.py
+++ b/modules/settings/tests/module_settings/fields/test_settings_lenient_related_fields_validators.py
@@ -8,7 +8,7 @@
 
 import pytest
 from background_tasks.settings import ENV_PREFIX, BackgroundTasksSettings
-from file_storage.settings import FileStorageSettings
+from file_storage.core.settings import FileStorageSettings
 from keycloak.core.settings import KeycloakSettings
 from pydantic import ValidationError
 from simple_module_core.settings_hydrate import RELATED_FIELDS_CTX, build_settings
diff --git a/modules/settings/tests/web/api/test_settings_module_api_json_fields.py b/modules/settings/tests/web/api/test_settings_module_api_json_fields.py
index 422c3d1d7..7628d25ee 100644
--- a/modules/settings/tests/web/api/test_settings_module_api_json_fields.py
+++ b/modules/settings/tests/web/api/test_settings_module_api_json_fields.py
@@ -78,7 +78,7 @@ async def test_editor_props_describe_the_input(authenticated_client):
 
 
 def test_input_type_unwraps_optional_scalars_only():
-    from file_storage.settings import FileStorageSettings
+    from file_storage.core.settings import FileStorageSettings
 
     assert input_type_for_field(BackgroundTasksSettings, "worker_concurrency") == ("int", True)
     assert input_type_for_field(BackgroundTasksSettings, "task_reject_on_worker_lost") == (
diff --git a/modules/tenants/tests/core/service/test_tenants_teardown_integration.py b/modules/tenants/tests/core/service/test_tenants_teardown_integration.py
index f42dd76f5..5578f4509 100644
--- a/modules/tenants/tests/core/service/test_tenants_teardown_integration.py
+++ b/modules/tenants/tests/core/service/test_tenants_teardown_integration.py
@@ -32,7 +32,7 @@ async def test_tenants_delete_removes_owned_data_but_retains_audit(
     app.state.background_tasks.settings.task_always_eager = True
     backend = FilesystemBackend(tmp_path)
     app.state.file_storage.backend = backend
-    monkeypatch.setattr("file_storage.tenant_deletion.build_backend", lambda settings: backend)
+    monkeypatch.setattr("file_storage.core.tenant_deletion.build_backend", lambda settings: backend)
     async with tenant_client() as owner:
         response = await owner.client.post(
             "/api/file-storage/upload",

From d24ea613672be7eb8697438e61ba9cd216c63045 Mon Sep 17 00:00:00 2001
From: Anto Subash <antosubash@live.com>
Date: Fri, 6 Nov 2026 02:59:51 +0100
Subject: [PATCH 2/2] docs(file_storage): fix stale paths in comments and docs
 after the layout move

Claude-Session: https://claude.ai/code/session_01FXHA3ZicrtZ4C5QPEgxfgq
---
 CHANGELOG.md                                                  | 2 +-
 docs/modules/file_storage.md                                  | 4 ++--
 modules/file_storage/file_storage/ui/utils/constants.ts       | 2 +-
 modules/file_storage/file_storage/ui/utils/types.ts           | 2 +-
 .../tests/multipart/guards/test_file_storage_upload_guards.py | 2 +-
 .../multipart/sessions/test_file_storage_uploads_minio.py     | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 451c1517c..526d280d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -96,7 +96,7 @@ All notable changes to this project are documented in this file. The format is b
 - `audit_log` follows the module layout: `audit_log.core.{constants,settings,services,capture}`, `audit_log.entries.{service,filters,resolve,activity,export}`, `audit_log.web.{deps,endpoints}`, and the page components move from `pages/components/` to `ui/components/`. The `simple_module.audit_sinks` entry point now targets `audit_log.core.capture:audit_callback`. Nothing outside the module imported the old paths, so no aliases remain.
 - `auth` follows the module layout: `auth.core.{constants,state}` and `auth.web.{deps,middleware}`; `auth.oidc_common` stays as a declared domain area. `auth.constants`, `auth.state`, `auth.deps` and `auth.middleware` still import, with a `DeprecationWarning`, until 0.0.46.
 - `tenants` follows the module layout: `tenants.core.{constants,settings,services,errors,service,user_cleanup}` (with the membership, owner-guard and deletion helpers), `tenants.resolution.{resolver,host_resolver,token_tenant}`, `tenants.invitations.{service,mail}`, `tenants.web.{deps,shared_props,endpoints}`, and the page components and hooks move to `ui/components` and `ui/hooks`. The invitation mail template moves to `invitations/templates/invitation.txt`. `tenants.constants`, `tenants.errors`, `tenants.host_resolver`, `tenants.resolver`, `tenants.service` and `tenants.deps` still import, with a `DeprecationWarning`, until 0.0.46. The durable handler names `tenants.user_cleanup.purge_user_memberships` and `tenants.send_invitation_email` are unchanged.
-- `file_storage` follows the module layout: `file_storage.core.{constants,settings,services,errors,scope,format,health,audit_labels,tenant_cache,tenant_deletion,object_reaper,worker,worker_support}`, `file_storage.files.*`, `file_storage.multipart.{sessions,guards,support,checksum}`, `file_storage.backends.guard`, `file_storage.web.{deps,serving,cors,csp,cookieless,body_limits,endpoints}`, and the page components, hook and helpers move to `ui/`. `file_storage.settings`, `.service`, `.deps`, `.scope`, `.downloads`, `.upload_support` and `.tenant_deletion` still import, with a `DeprecationWarning`, until 0.0.46. The durable `TenantStorageCleanupRequested` event key and its handler names, and the Celery task names, are unchanged.
+- `file_storage` follows the module layout: `file_storage.core.{constants,settings,services,errors,scope,format,health,audit_labels,tenant_cache,tenant_deletion,object_reaper,worker,worker_support}`, `file_storage.files.*`, `file_storage.multipart.{sessions,guards,support,checksum}`, `file_storage.backends.guard`, `file_storage.web.{deps,serving,cors,csp,cookieless,body_limits,endpoints}`, and the page components, hook and helpers move to `ui/`. `file_storage.settings`, `.service`, `.deps`, `.scope`, `.downloads`, `.upload_support` and `.tenant_deletion` still import, with a `DeprecationWarning`, until 0.0.46; the other old flat paths (`.constants`, `.errors`, `.services`, `.endpoints.*`, `.upload_guards`, `.uploads`, `.checksum`, `.worker`, `.cors`, `.csp` and so on) have no alias. The durable `TenantStorageCleanupRequested` event key and its handler names, and the Celery task names, are unchanged.
 
 
 - Coalesce concurrent tenant membership and permission grant cache misses. In-flight invalidation retries against fresh authorization data; failures and cancellation release waiting readers. Cache unknown tenant subdomains for five seconds and drop the new slug's host lookups (on a new `tenants.hosts` invalidation channel, so no user id is read as a slug) and the owner's memberships after committed tenant creation; other users' caches are not cleared. Services built outside request dependencies pass `invalidate_hosts=make_host_invalidator(app)` beside `invalidate=make_invalidator(app)`. Retries after concurrent invalidation are bounded to three reads (2026-11-05 local performance review).
diff --git a/docs/modules/file_storage.md b/docs/modules/file_storage.md
index c00de307f..fd577c4b5 100644
--- a/docs/modules/file_storage.md
+++ b/docs/modules/file_storage.md
@@ -453,7 +453,7 @@ files the caller uploaded (`created_by` is their user id), unless they hold
 `file_storage.manage`. Someone else's file answers `404`, exactly like an
 unknown id, and the browse screen's type and uploader filters list only the
 caller's own rows (the usage figure stays bucket-wide, as the quota is). The
-scope is passed explicitly by the endpoints (`deps.get_owner_scope`) to the
+scope is passed explicitly by the endpoints (`web.deps.get_owner_scope`) to the
 service's `owner=` argument; internal callers such as branding and reapers
 pass none and stay unscoped, and anonymous `public` serving is unaffected.
 
@@ -486,7 +486,7 @@ class MyModule(ModuleBase):
 ## Inertia pages
 
 - `FileStorage/Browse.tsx` — file list + upload dropzone; handles the upload progress + delete confirmation flow. Each row shows a "Public" badge and a make public / make private action.
-- `FileStorage/components/UploadDropzone.tsx` — drag-drop upload child component.
+- `ui/components/UploadDropzone.tsx` — drag-drop upload child component.
 
 ## Locales
 
diff --git a/modules/file_storage/file_storage/ui/utils/constants.ts b/modules/file_storage/file_storage/ui/utils/constants.ts
index 5a374b025..1f4c648ee 100644
--- a/modules/file_storage/file_storage/ui/utils/constants.ts
+++ b/modules/file_storage/file_storage/ui/utils/constants.ts
@@ -1,4 +1,4 @@
-// TSX-side mirror of file_storage/constants.py — keep in sync.
+// TSX-side mirror of file_storage/core/constants.py — keep in sync.
 // All routes and permission strings used by Browse.tsx and its components are
 // declared here so the JSX has no magic strings.
 
diff --git a/modules/file_storage/file_storage/ui/utils/types.ts b/modules/file_storage/file_storage/ui/utils/types.ts
index b3ea8c717..04071a725 100644
--- a/modules/file_storage/file_storage/ui/utils/types.ts
+++ b/modules/file_storage/file_storage/ui/utils/types.ts
@@ -1,4 +1,4 @@
-/** Shapes of the `FileStorage/Browse` Inertia props — mirrors endpoints/views.py. */
+/** Shapes of the `FileStorage/Browse` Inertia props — mirrors web/endpoints/views.py. */
 
 export interface StoredFile {
   id: string;
diff --git a/modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py b/modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py
index 37f242bdb..7b4530788 100644
--- a/modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py
+++ b/modules/file_storage/tests/multipart/guards/test_file_storage_upload_guards.py
@@ -1,4 +1,4 @@
-"""Direct unit tests for ``upload_guards.UploadGuards`` (#454), without the HTTP layer."""
+"""Direct unit tests for ``multipart.guards.UploadGuards`` (#454), without the HTTP layer."""
 
 from __future__ import annotations
 
diff --git a/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
index 57750c92d..e98285519 100644
--- a/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
+++ b/modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
@@ -3,7 +3,7 @@
 Skipped unless ``SM_TEST_S3_ENDPOINT`` is set, e.g.::
 
     SM_TEST_S3_ENDPOINT=http://localhost:9000 uv run pytest \\
-        modules/file_storage/tests/test_file_storage_uploads_minio.py
+        modules/file_storage/tests/multipart/sessions/test_file_storage_uploads_minio.py
 
 Credentials default to the dev stack's ``minioadmin``/``minioadmin`` and the
 test creates (and leaves) a bucket named ``sm-multipart-test``.