RETENTION — INDEFINITE OBJECTS, TOKEN-GATED

throway is disposable by default. When the server has a retain token
configured (see /api limits: "retention_token"), requests that
authenticate with it create objects that NEVER expire and are exempt
from pool eviction:

  curl -X POST --data-binary @skill.tar.gz \
       -H "Authorization: Bearer <token>" \
       "https://skale.dev/throway/?name=skill.tar.gz"

Rules:
- Token: "Authorization: Bearer <token>" header or "?token=<token>"
  query param. Query strings can reach server logs — prefer the header.
- Works for single files, bundles, dirs, ?share= names and ?url=
  server-side imports alike.
- Retained objects answer "expires_at": null and carry
  persistence.retention = "indefinite".
- Reads stay PUBLIC (anyone with the URL). Writes and deletes on
  retained objects REQUIRE the token (401 otherwise).
- Token-authenticated PUT/PATCH on an existing object makes it
  indefinite — write implies retention.
- POST https://skale.dev/throway/<id>?retain=1 (with token) flips an EXISTING file or
  bundle to indefinite; POST https://skale.dev/throway/d/<key>?retain=1 flips a dir.
  Idempotent.
- "&once=1" (burn-after-reading) cannot be combined with retention (400).
- Retained units are never swept and never pool-evicted; when the pool
  runs tight, only disposable units are evicted.

SHOW-DIRS — permanent, publicly writable dirs

  curl -X POST -H "Authorization: Bearer <token>" \
       "https://skale.dev/throway/?dir=1&show=1&name=team-board"

- A show-dir is retained (never expires, never evicted) AND open:
  EVERYONE with the URL can add, edit and delete files — no token.
- Creating or flipping needs the token. Deleting the WHOLE dir needs
  the token too (protects the retention promise); file-level deletes
  stay open.
- Flip an existing dir: POST https://skale.dev/throway/d/<key>?show=1 (token).
- Dir responses carry "open": true; the edit history records every
  change, so abuse is traceable even without auth.

Errors: 401 invalid retain token / token required / retention not
enabled; 400 once=1 combined with retention.

curl -A curl https://skale.dev/throway/help/retention             # this topic as plain text