Repository recovery runbook

Stop worker before inspecting or repairing a repository; never edit a live repository behind an active lease.
Preserve the repository directory and its metadata volume before remediation.
Verify repository state through the operator API and verify individual backups before any restore. Treat a corrupt verification result as an incident, not a deletion request.
Mount replacement repository roots at the same allowlisted path, restore metadata, then start migrate, web, scheduler, and finally worker.
Keep archived repositories mounted until retention and restore obligations expire. Do not remove manifests or blobs manually.