Function copy_object_with_fallback 

pub async fn copy_object_with_fallback(
    client: &Client,
    src_bucket: &str,
    src_key: &str,
    dest_bucket: &str,
    dest_key: &str,
    options: &CopyOptions,
    fallback_threshold_bytes: u64,
    confirmed_token: Option<String>,
    confirmation_cache: &ConfirmationCache,
    profile: &str,
) -> Result<CopyOutcome, AppError>

Copy src_bucket/src_key to dest_bucket/dest_key with a cross-account fallback.

Behaviour

1. Attempt server-side CopyObject.
2. On AccessDenied (cross-account signal): a. HEAD the source to learn content_length. b. If content_length <= fallback_threshold_bytes → download + upload (fallback path). Returns CopyOutcome::FallbackUsed. c. If content_length > fallback_threshold_bytes and confirmed_token is not a valid unconsumed token for this scope → return AppError::Validation asking for explicit confirmation. d. If content_length > fallback_threshold_bytes and confirmed_token is valid → fallback path proceeds. Returns CopyOutcome::FallbackUsed.
3. On any other error → propagate as-is.

Confirmation token

The token must be minted by ConfirmationCache::mint with a matching ConfirmScope and consumed here. The frontend obtains a token via the cross_account_confirm command, then re-calls object_copy with the token.

OCP

fallback_threshold_bytes is parameterised (driven by settings) so the default can change without touching this function.