feat: govern file lifecycle and connector writes

tests/test_manifest_documentation.py

@@ -11,6 +11,7 @@ STATIC_TOPIC_IDS = {
     "files.workflow.find-and-download-files",
     "files.workflow.share-managed-files",
     "files.workflow.delete-managed-files",
+    "files.workflow.restore-retain-and-purge",
     "files.governed-connectors-and-provenance",
     "files.reference.integrity-recovery-and-fail-closed-transports",
     "files.reference.shared-storage-profile",
@@ -119,11 +120,16 @@ class FilesManifestDocumentationTests(unittest.TestCase):
 
         delete = self.topic("files.workflow.delete-managed-files")
         self.assertIn("Soft-delete", delete.summary)
-        self.assertIn("no self-service restore or hard-purge", delete.body)
+        self.assertIn("Authorized restoration", delete.body)
         self.assertTrue(
-            any("not a hard purge" in item for item in delete.metadata["limitations"])
+            any("soft deletion" in item.casefold() for item in delete.metadata["limitations"])
         )
 
+        lifecycle = self.topic("files.workflow.restore-retain-and-purge")
+        self.assertIn("legal hold", lifecycle.body)
+        self.assertIn("preview hash", lifecycle.body)
+        self.assertIn("recovery ledger", lifecycle.body)
+
     def test_admin_topic_covers_policy_redaction_and_atomic_credential_deletion(
         self,
     ) -> None:
@@ -144,6 +150,9 @@ class FilesManifestDocumentationTests(unittest.TestCase):
         self.assertIn("deny rules win", topic.body)
         self.assertIn("redact secret values", topic.body)
         self.assertIn("same transaction", topic.body)
+        self.assertIn("read-only by default", topic.body)
+        self.assertIn("S3", topic.body)
+        self.assertIn("Automatic remote deletion", topic.body)
         self.assertTrue(
             any(
                 "non-owned external references" in item
@@ -179,6 +188,8 @@ class FilesManifestDocumentationTests(unittest.TestCase):
         )
         self.assertIn("lease-fenced Core recovery", topic.body)
         self.assertIn("Ops", topic.body)
+        self.assertIn("Hard purge", topic.body)
+        self.assertIn("S3 connector write-back", topic.body)
         self.assertTrue(topic.metadata["verification"])
         self.assertIn(
             "/api/v1/files/integrity/scans",
@@ -224,8 +235,9 @@ class FilesManifestDocumentationTests(unittest.TestCase):
         self.assertIn("process_owner", topic.audience)
         self.assertIn("release_manager", topic.audience)
         self.assertIn("versions align", topic.body)
-        self.assertIn("Share grant, change, expiry, and revocation", topic.body)
-        self.assertIn("no enforced retention or legal hold", topic.body)
+        self.assertIn("share lifecycle", topic.body)
+        self.assertIn("legal hold", topic.body)
+        self.assertIn("S3 write-back", topic.body)
         for key in ("prerequisites", "steps", "outcome", "verification"):
             self.assertTrue(topic.metadata[key])
         self.assertTrue(