docs: extend Files recovery operations

2026-08-20 22:07:25 +02:00
parent 6ecb94c99e
commit 399e1f8e80
2 changed files with 11 additions and 1 deletions
@@ -216,6 +216,15 @@ Ops ledger row. Run a complete Files integrity scan after such a loss and
 reconcile reported orphans before resuming writes. PostgreSQL retains the
 independent pre-effect recovery-intent guarantee required for production.

+Files hard-purge and S3 connector-write operations use independently durable
+Core recovery records and distributed fences. A purge releases database
+references before a separate, reference-checked blob-GC operation deletes
+bytes. An S3 write records only an opaque target digest plus request/content
+evidence and verifies provider metadata after its conditional effect. When Ops
+shows `outcome_unknown` or `recovery_required`, do not replay the action from
+Ops: reconcile the exact blob reference/object or S3 request/content markers
+through the owning Files workflow first.
+
 Production migrations should run explicitly before startup or package
 activation. Module install/uninstall workflows must use database backup and
 restore-check hooks for PostgreSQL before migrations or destructive retirement.