Function persist_upload_bytes 

pub async fn persist_upload_bytes(
    bytes: Vec<u8>,
    filename: &str,
    session_id: &str,
    upload_root: &str,
    sessions: &SessionStore,
) -> Result<FileEntryResult, JsonRpcError>

Hash, deduplicate, persist, and index one uploaded payload for the live session session_id, under the session map lock (see persist_into_index). A session that is not live is refused before anything is written, rather than reported as a successful upload with no index entry.

This binds only the session id. file/attach and file/upload/commit commit through the dispatcher instead, which binds the exact session incarnation and rechecks authority inside the same lock.