feat: govern file lifecycle and connector writes

README.md

@@ -123,8 +123,16 @@ socket policy. Retries, redirects, endpoint discovery, bucket aliases, and new
 connections are therefore revalidated while TLS keeps the configured hostname
 for SNI and certificate checks. Connector clients do not use outbound proxies or
 ambient AWS credential discovery; configure credentials on the governed profile,
-or explicitly use an anonymous profile for public objects. An incompatible SDK
-upgrade fails closed before a usable client/session is returned.
+or explicitly use an anonymous profile for public objects. Keep connector spaces
+read-only unless a remote write is explicitly needed.
+An S3 profile with the `write` capability can back a two-way connector space.
+`POST /api/v1/files/connector-spaces/{space_id}/write-back` then conditionally
+creates or replaces one remote object from a managed file, records durable
+recovery intent before the provider effect, and verifies request/content markers
+afterward. Automatic remote delete, rename, move, and ACL propagation remain
+disabled; other connector providers remain read-only.
+An incompatible SDK upgrade fails closed before a usable client/session is
+returned.
 
 Durable platform storage has a separate deployment boundary: installer-owned
 Garage is accepted only at its exact generated endpoint, while an