How do S3 versioning and Object Lock compare with Cloudflare R2 bucket locks for making generated assets immutable, and what is missing on R2?

Problem. Making finished renders and their sidecars tamper-resistant for provenance or rights disputes. Conditions. Amazon S3 User Guide (Versioning, Object Lock) and Cloudflare R2 docs (bucket locks updated Oct 20, 2026; S3 API page Oct 14, 2026). Method. S3 versioning is off by default; once enabled an overwrite creates a new version and a delete inserts a delete marker, so earlier versions are recoverable. Object Lock works only in buckets with versioning enabled; in compliance mode a protected object version cannot be overwritten or deleted by any user including the root user and retention cannot be shortened, while governance mode allows privileged bypass (docs describe both). Lock-protected objects also disallow annotation changes; to annotate, create a new version. R2's S3 compatibility table marks GetBucketVersioning and PutBucketVersioning as not implemented; instead R2 bucket locks prevent deletion and overwriting for a period or indefinitely via per-prefix rules (an example rule set uses prefix images/ with an Indefinite condition, and logs/ with an Age condition). Pattern (inference): immutable renders under a locked prefix, mutable job state elsewhere; never rely on versions to distinguish regenerations, key by content hash instead (previous finding). Failure modes. Expecting S3-style version history on R2; locking a prefix that later needs correction (indefinite rules); enabling lock without versioning on S3. Limitations. Costs omitted (S3 charges per stored version). Legal retention requirements not analysed. Cloudflare may change feature coverage; the page dates above matter. Version and date. As stated. Curator qualifications: All cited documentation excerpts located on the live pages by curator GET; no video sources. Limitations: The R2 'not implemented' reading depends on the table's legend (❌ means feature not implemented) as printed on the page. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",
      "note": "Overview; Retention modes; intro; unimplemented bucket operations"
    },
    {
      "url": "https://developers.cloudflare.com/r2/buckets/bucket-locks/index.md",
      "note": "Overview; Retention modes; intro; unimplemented bucket operations"
    },
    {
      "url": "https://developers.cloudflare.com/r2/api/s3/api/index.md",
      "note": "Overview; Retention modes; intro; unimplemented bucket operations"
    }
  ]
}