feat(jobs): jobs describe themselves — description, mutates, repair_description

The admin panel had no repair toggle wired to anything but a hardcoded
name list naming the two refcount tenants, so `thumb_derived_import` and
`thumb_attached_import` could not be run in repair mode from the UI at
all despite supporting it. And nothing in the job list said what any
given job does or whether clicking Run on production writes anything.

Three defaulted methods on `JobHandler` and `RecoverableJobHandler`:

    fn description(&self) -> &'static str
    fn mutates(&self) -> Mutates          // Never | Always | OnRepairOnly
    fn repair_description(&self) -> Option<&'static str>

`RecoverableAdapter` forwards them — the registry only holds
`dyn JobHandler`, so a tenant's metadata is invisible otherwise, and
falling back to the defaults would report every recoverable job as
read-only, including the ones that delete files.

Three values rather than a boolean because a job can be read-only by
default and destructive under `?repair=true`; a boolean answers wrongly
for one of its two modes, and `false` on something that unlinks files is
the dangerous direction to be wrong in. `repair_description` returning
`Option` collapses "does it repair" and "what does repair do" into one
method: presence gates the toggle, content is the confirmation text —
which the frontend cannot invent, since correcting a counter and
deleting sidecars are not the same warning.

`OnRepairOnly` with no `repair_description` is rejected at registration:
it claims to mutate only under a flag it does not support.

All 17 registered jobs declare all three. The panel now renders the
description under each name, badges read-only jobs, confirms before a
plain run of a mutating one, and offers the repair variant off the
backend flag instead of the name list.

Descriptions are English in the trait, next to the behaviour: one in
`locales/*.json` rots invisibly the moment a job changes, and a
translator cannot know what `manifests_consistency` reconciles. i18n can
layer on later keyed by job name with these as the fallback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/infrastructure/services/backend_consistency_service.rs

@@ -147,6 +147,14 @@ impl RecoverableJobHandler for BackendConsistencyCheck {
         BACKEND_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Merge-joins the storage backend's blob enumeration against \
+         storage.blobs, both ordered by hash, so one pass yields the delta \
+         in both directions: bytes on the backend no DB row claims, and \
+         rows whose bytes are gone. Read-only — nothing is uploaded or \
+         deleted."
+    }
+
     /// Approximate total: on a healthy install every backend blob
     /// has a `storage.blobs` row, so the DB count is a proxy for
     /// the backend count. The fraction deviating from 1.0 at run

src/infrastructure/services/backend_migration_service.rs

@@ -59,8 +59,8 @@ use crate::application::ports::blob_storage_ports::BlobStorageBackend;
 use crate::common::config::NamedStorageEntry;
 use crate::common::errors::DomainError;
 use crate::infrastructure::scheduler::{
-    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, RecoverableJobHandler, RunOutcome,
-    RunStatus, record_or_log,
+    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, Mutates, RecoverableJobHandler,
+    RunOutcome, RunStatus, record_or_log,
 };
 use crate::infrastructure::services::encrypted_blob_backend::{EncryptedBlobBackend, HeadCheck};
 use crate::infrastructure::services::entry_backend::{
@@ -188,6 +188,20 @@ impl RecoverableJobHandler for BackendMigrationService {
         BACKEND_MIGRATION_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Copies every blob payload from the backend the server booted with \
+         to the one the current storage settings describe. Covers legacy \
+         whole-file blobs and CDC chunks in a single walk. Resumable — a \
+         paused or crashed run continues from its cursor rather than \
+         restarting."
+    }
+
+    /// Writes bytes to the target backend. Source bytes are left in place —
+    /// the copy is additive, so an aborted migration loses nothing.
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
     /// Definitive count — one row per blob. `SELECT COUNT(*) FROM
     /// storage.blobs` on a modern PG is a sub-second index-only scan
     /// even at millions of rows.

src/infrastructure/services/backend_rotate_service.rs

@@ -62,8 +62,8 @@ use crate::application::ports::blob_storage_ports::BlobStorageBackend;
 use crate::common::config::NamedStorageEntry;
 use crate::common::migration_progress::MigrationProgress;
 use crate::infrastructure::scheduler::{
-    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, RecoverableJobHandler, RunOutcome,
-    RunStatus, record_or_log,
+    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, Mutates, RecoverableJobHandler,
+    RunOutcome, RunStatus, record_or_log,
 };
 use crate::infrastructure::services::encrypted_blob_backend::BlobFormat;
 use crate::infrastructure::services::entry_backend::build_entry_backend_typed;
@@ -135,6 +135,20 @@ impl RecoverableJobHandler for BackendRotateService {
         BACKEND_ROTATE_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Brings every blob's on-disk format in line with the storage \
+         entry's current head key: encrypts plaintext, re-encrypts under a \
+         rotated key, decrypts when the head is 'none', and upgrades \
+         legacy blobs to v1. Blobs already in the right format are skipped, \
+         so re-running after a key change is cheap."
+    }
+
+    /// Rewrites blobs **in place**. Unlike a migration this has no additive
+    /// fallback — the previous ciphertext is gone once a blob is rewritten.
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
     /// Definitive count — one row per blob. Same query as
     /// `backend_migration::count_total`; the two walk the same rows.
     async fn count_total(&self) -> Option<u64> {

src/infrastructure/services/blobs_consistency_service.rs

@@ -67,8 +67,8 @@ use crate::application::ports::blob_reference_ports::{BlobReferenceRegistry, Ref
 use crate::application::ports::blob_storage_ports::BlobStorageBackend;
 use crate::common::config::NamedStorageEntry;
 use crate::infrastructure::scheduler::{
-    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, RecoverableJobHandler, RunOutcome,
-    RunStatus, record_or_log,
+    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, Mutates, RecoverableJobHandler,
+    RunOutcome, RunStatus, record_or_log,
 };
 use crate::infrastructure::services::entry_backend::build_entry_backend;
 
@@ -223,6 +223,29 @@ impl RecoverableJobHandler for BlobsConsistencyCheck {
         BLOBS_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Walks storage.blobs and checks each row against the reference- \
+         counting invariants dedup_gc relies on, and probes the backend \
+         once per row for missing bytes. That probe costs one backend \
+         call per blob — backend_consistency finds the same missing \
+         bytes in a single merge-join pass, and orphaned bytes too, so \
+         prefer it on large installs. Add ?deep=true to re-read and \
+         re-hash every blob for bit-rot; that is a full read of storage."
+    }
+
+    fn mutates(&self) -> Mutates {
+        Mutates::OnRepairOnly
+    }
+
+    fn repair_description(&self) -> Option<&'static str> {
+        Some(
+            "Rewrites drifted ref_count values to the recomputed truth. \
+             Does not delete blobs or resurrect missing bytes — an \
+             over-counted blob simply becomes eligible for the next \
+             dedup_gc sweep.",
+        )
+    }
+
     /// Definitive count. `storage.blobs` PK scan is index-only;
     /// even at millions of rows it's sub-second on modern PG.
     async fn count_total(&self) -> Option<u64> {

src/infrastructure/services/consistency_batch_service.rs

@@ -59,7 +59,7 @@ use std::sync::{Arc, Weak};
 use async_trait::async_trait;
 use serde_json::json;
 
-use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs};
+use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs, Mutates};
 
 pub const CONSISTENCY_BATCH_JOB_NAME: &str = "consistency_batch";
 
@@ -90,6 +90,28 @@ impl JobHandler for ConsistencyBatch {
         CONSISTENCY_BATCH_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Runs every registered consistency check in sequence — one click \
+         for 'check everything'. New tenants are picked up automatically \
+         by name, so nothing needs updating here when one is added. Flags \
+         are forwarded to each sub-job."
+    }
+
+    /// Read-only on a plain run because every tenant it dispatches is, but
+    /// `?repair=true` reaches whichever of them act on it — so the batch
+    /// inherits the strongest mode any sub-job can be put into.
+    fn mutates(&self) -> Mutates {
+        Mutates::OnRepairOnly
+    }
+
+    fn repair_description(&self) -> Option<&'static str> {
+        Some(
+            "Forwards ?repair=true to every sub-check, so the ones that \
+             support it fix what they find (today: refcount drift on blobs \
+             and manifests) instead of only reporting it.",
+        )
+    }
+
     async fn run(&self, args: &JobRunArgs) -> JobOutcome {
         // Upgrade the Weak. Only fails if the registry has been
         // dropped — which can only happen during process shutdown,

src/infrastructure/services/dedup_service.rs

@@ -3675,6 +3675,20 @@ impl crate::infrastructure::scheduler::JobHandler for DedupService {
         DEDUP_GC_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Reclaims blobs and chunk manifests that no file, thumbnail or \
+         preview references any more, once they are past the orphan grace \
+         window. Trash cleanup already runs this as its tail step; \
+         triggering it here is for reclaiming immediately rather than at \
+         the next tick. Add ?force=true to skip the grace window."
+    }
+
+    /// Deletes bytes. `force` is its accelerator, not a repair flag —
+    /// there is nothing this job reports without also acting on it.
+    fn mutates(&self) -> crate::infrastructure::scheduler::Mutates {
+        crate::infrastructure::scheduler::Mutates::Always
+    }
+
     /// Runs one `garbage_collect` sweep — the same reclamation that
     /// `TrashCleanupService` invokes inline as its tail step, exposed
     /// through the scheduler so operators can trigger it uniformly via

src/infrastructure/services/drives_consistency_service.rs

@@ -72,6 +72,13 @@ impl RecoverableJobHandler for DrivesConsistencyCheck {
         DRIVES_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Compares each drive's cached used_bytes against the actual sum of \
+         its file sizes and reports the drift. Read-only — usage_reconcile \
+         is what corrects the counter; this surfaces WHEN it drifts so the \
+         cause can be traced (missed delta, silent failure, race)."
+    }
+
     /// Definitive count — one row per drive, table is tiny (dozens per
     /// install), COUNT(*) is trivially fast. Enables progress bar on
     /// the admin UI.

src/infrastructure/services/files_consistency_service.rs

@@ -148,6 +148,13 @@ impl RecoverableJobHandler for FilesConsistencyCheck {
         FILES_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Walks storage.files and reports rows whose parent-folder state, \
+         blob reference or denormalised size has drifted from what the \
+         join with folders and blobs says is true. Read-only — the fixes \
+         live in other jobs (trash cascade, dedup_gc, blob resurrection)."
+    }
+
     /// Definitive count — one row per file. This is the largest table
     /// of the trio (millions on big installs); COUNT(*) is still an
     /// index-only scan but can take ~seconds. The tradeoff is worth

src/infrastructure/services/folders_consistency_service.rs

@@ -120,6 +120,14 @@ impl RecoverableJobHandler for FoldersConsistencyCheck {
         FOLDERS_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Walks storage.folders and reports rows whose materialised path \
+         and lpath have drifted from what walking the parent_id chain \
+         produces. Any write path that bypasses the ltree cascade trigger \
+         can leave these wrong, which silently breaks subtree queries. \
+         Read-only."
+    }
+
     /// Definitive count — one row per folder. Larger table than drives
     /// but the COUNT(*) is still index-only on PG. On multi-million-row
     /// deployments this is ~100ms at run start; acceptable given the

src/infrastructure/services/grant_cleanup_service.rs

@@ -23,7 +23,7 @@ use tracing::{error, info};
 
 use crate::application::ports::authorization_ports::AuthorizationEngine;
 use crate::common::errors::DomainError;
-use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs};
+use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs, Mutates};
 use crate::infrastructure::services::pg_acl_engine::PgAclEngine;
 use async_trait::async_trait;
 
@@ -122,6 +122,18 @@ impl JobHandler for GrantCleanupService {
         GRANT_CLEANUP_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Deletes expired role grants once they are past the retention \
+         window. Expired grants never leak permission — every AuthZ check \
+         filters on expires_at — they just accumulate. The window keeps \
+         'what happened to my access?' answerable for a few weeks after \
+         expiry."
+    }
+
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
     /// Runs one purge. `count` on the returned `JobOutcome::Ok` is
     /// the number of `role_grants` rows physically deleted;
     /// `extra.grace_days` records which grace was applied so admin

src/infrastructure/services/manifests_consistency_service.rs

@@ -46,8 +46,8 @@ use sqlx::PgPool;
 
 use crate::application::ports::blob_reference_ports::{BlobReferenceRegistry, RefLevel};
 use crate::infrastructure::scheduler::{
-    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, RecoverableJobHandler, RunOutcome,
-    RunStatus, record_or_log,
+    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, Mutates, RecoverableJobHandler,
+    RunOutcome, RunStatus, record_or_log,
 };
 
 pub const MANIFESTS_CONSISTENCY_JOB_NAME: &str = "manifests_consistency";
@@ -139,6 +139,26 @@ impl RecoverableJobHandler for ManifestsConsistencyCheck {
         MANIFESTS_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Reconciles storage.chunk_manifests.ref_count against its actual \
+         referrers. There are two reference counters — a chunk reference \
+         lands on storage.blobs.ref_count, a whole-Blob reference on the \
+         manifest — and only the first was ever verified; this covers the \
+         other half."
+    }
+
+    fn mutates(&self) -> Mutates {
+        Mutates::OnRepairOnly
+    }
+
+    fn repair_description(&self) -> Option<&'static str> {
+        Some(
+            "Rewrites drifted manifest ref_count values to the recomputed \
+             truth. Nothing is deleted here — a corrected count only makes \
+             the manifest eligible for a later dedup_gc sweep.",
+        )
+    }
+
     async fn count_total(&self) -> Option<u64> {
         let row: Result<(i64,), sqlx::Error> =
             sqlx::query_as("SELECT COUNT(*) FROM storage.chunk_manifests")

src/infrastructure/services/satellites_consistency_service.rs

@@ -204,6 +204,15 @@ impl RecoverableJobHandler for SatellitesConsistencyCheck {
         SATELLITES_CONSISTENCY_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Walks both satellite tables — content_derived_blobs (thumbnails \
+         keyed by source content) and file_attached_blobs (previews keyed \
+         by file) — and reports mappings whose source or target no longer \
+         exists. Nothing else finds these: every other job reasons from a \
+         Blob outwards, and a satellite row pointing at a deleted source \
+         breaks none of their invariants. Read-only."
+    }
+
     async fn count_total(&self) -> Option<u64> {
         sqlx::query_as::<_, (i64,)>(
             "SELECT (SELECT COUNT(*) FROM storage.content_derived_blobs)

src/infrastructure/services/session_cleanup_service.rs

@@ -35,7 +35,7 @@ use tracing::{error, info};
 
 use crate::domain::repositories::session_repository::SessionRepository;
 use crate::infrastructure::repositories::SessionPgRepository;
-use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs};
+use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs, Mutates};
 
 /// How long a session row survives past its `expires_at` before this
 /// janitor deletes it. Enough time for a security review of a
@@ -84,6 +84,17 @@ impl JobHandler for SessionCleanupService {
         Self::JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Deletes session rows long past their expiry. They cannot \
+         authenticate — expiry is checked at every auth path — but the row \
+         keeps a forensic trail (which user, from which IP, minted how) \
+         for a retention window after expiry, then becomes dead weight."
+    }
+
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
     /// Runs one bulk-delete of long-expired session rows. `count` on
     /// the returned `JobOutcome::Ok` is the number of rows dropped
     /// this tick; `extra` records the retention window operators can

src/infrastructure/services/thumb_attached_import_service.rs

@@ -46,8 +46,8 @@ use uuid::Uuid;
 
 use crate::application::ports::thumbnail_ports::ThumbnailSize;
 use crate::infrastructure::scheduler::{
-    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, RecoverableJobHandler, RunOutcome,
-    RunStatus, record_or_log,
+    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, Mutates, RecoverableJobHandler,
+    RunOutcome, RunStatus, record_or_log,
 };
 use crate::infrastructure::services::dedup_service::DedupService;
 // The readback-then-unlink rule is shared, not copied: two versions of it
@@ -167,6 +167,28 @@ impl RecoverableJobHandler for ThumbAttachedImport {
         THUMB_ATTACHED_IMPORT_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Migrates USER-UPLOADED previews (ext-{file_id}.jpg) into \
+         file-keyed blob storage. Until a row exists, copying a file loses \
+         its preview: the sidecar is keyed by file id and no copy path \
+         duplicates it. These bytes have no server-side render path, so \
+         unlike rendered thumbnails they cannot be regenerated."
+    }
+
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
+    fn repair_description(&self) -> Option<&'static str> {
+        Some(
+            "Also DELETES each sidecar once its replacement has been read \
+             back. Previews whose file no longer exists are deleted without \
+             a readback — nothing can reference them again. Irreversible, \
+             and these bytes cannot be regenerated, so the readback is the \
+             only safeguard.",
+        )
+    }
+
     async fn count_total(&self) -> Option<u64> {
         let mut total = 0u64;
         for size in ThumbnailSize::all() {
@@ -308,10 +330,12 @@ impl RecoverableJobHandler for ThumbAttachedImport {
                     // there is no row and no blob to read back, and nothing to
                     // regenerate from either.
                     orphaned += 1;
+                    let mut removed = false;
                     if delete_imported {
                         let path = self.thumbnails_root.join(&dir_name).join(&name);
                         if fs::remove_file(&path).await.is_ok() {
                             deleted += 1;
+                            removed = true;
                             // Explicit: nothing to verify against, so this
                             // bypasses verify_and_unlink. Worth auditing
                             // loudest of all — these bytes were
@@ -325,22 +349,35 @@ impl RecoverableJobHandler for ThumbAttachedImport {
                                 &path,
                             );
                         }
-                    } else {
-                        record_or_log(
-                            store,
-                            THUMB_ATTACHED_IMPORT_JOB_NAME,
-                            "attached_sidecar_orphan",
-                            "anomaly",
-                            None,
-                            serde_json::json!({
-                                "path":    position,
-                                "file_id": file_id_str,
-                                "note":    "no storage.files row; unimportable, and deleted on a \
-                                            repair run since nothing can reference it again",
-                            }),
-                        )
-                        .await;
                     }
+                    // Recorded in BOTH modes — see the twin in
+                    // thumb_derived_import. Deleting a non-regenerable
+                    // user-uploaded preview and reporting nothing is the
+                    // worst version of this: the one outcome an operator
+                    // needs in the run drawer was the one it withheld.
+                    record_or_log(
+                        store,
+                        THUMB_ATTACHED_IMPORT_JOB_NAME,
+                        "attached_sidecar_orphan",
+                        // `anomaly` renders as "notices"; `detail.deleted`
+                        // is what says whether the run acted. See the
+                        // derived twin.
+                        "anomaly",
+                        None,
+                        serde_json::json!({
+                            "path":    position,
+                            "file_id": file_id_str,
+                            "deleted": removed,
+                            "note": if removed {
+                                "no storage.files row; sidecar was unimportable and has been \
+                                 deleted — nothing can reference it again"
+                            } else {
+                                "no storage.files row; unimportable, and deleted on a repair \
+                                 run since nothing can reference it again"
+                            },
+                        }),
+                    )
+                    .await;
                 } else {
                     let path = self.thumbnails_root.join(&dir_name).join(&name);
                     match fs::read(&path).await {
@@ -458,7 +495,16 @@ impl RecoverableJobHandler for ThumbAttachedImport {
              {unverified} kept unverified"
         );
 
-        RunOutcome::completed()
+        // Same reasoning as the derived twin: what the run did belongs on
+        // the run row, not only in the process log.
+        RunOutcome::completed_with(serde_json::json!({
+            "imported":        imported,
+            "already_present": already,
+            "deleted":         deleted,
+            "unverified":      unverified,
+            "orphaned":        orphaned,
+            "failed":          failed,
+        }))
     }
 }
 

src/infrastructure/services/thumb_derived_import_service.rs

@@ -41,8 +41,8 @@ use tokio::fs;
 
 use crate::application::ports::thumbnail_ports::{ThumbnailFormat, ThumbnailSize};
 use crate::infrastructure::scheduler::{
-    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, RecoverableJobHandler, RunOutcome,
-    RunStatus, record_or_log,
+    JobRegistry, JobRunArgs, JobStore, JobStoreProvider, Mutates, RecoverableJobHandler,
+    RunOutcome, RunStatus, record_or_log,
 };
 use crate::infrastructure::services::dedup_service::DedupService;
 
@@ -230,6 +230,29 @@ impl RecoverableJobHandler for ThumbDerivedImport {
         THUMB_DERIVED_IMPORT_JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Migrates server-rendered thumbnails from the legacy .thumbnails/ \
+         directory into content-addressed blob storage. Local-disk sidecars \
+         are invisible to other instances and are not carried by a backend \
+         migration; importing them is what lets that directory be deleted."
+    }
+
+    /// `Always`: a plain run inserts rows and writes blobs. Repair-capable on
+    /// top of that, which is why the two are independent.
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
+    fn repair_description(&self) -> Option<&'static str> {
+        Some(
+            "Also DELETES each sidecar once its replacement has been read \
+             back from blob storage, and removes the directory when empty. \
+             Files whose source no longer exists are deleted without a \
+             readback — they cannot be imported and nothing can reference \
+             them. Irreversible.",
+        )
+    }
+
     async fn count_total(&self) -> Option<u64> {
         let mut total = 0u64;
         for size in ThumbnailSize::all() {
@@ -390,10 +413,12 @@ impl RecoverableJobHandler for ThumbDerivedImport {
                     // since there is nothing to read back and nothing to
                     // regenerate from.
                     dead_source += 1;
+                    let mut removed = false;
                     if delete_imported {
                         let path = self.thumbnails_root.join(dir_name).join(&name);
                         if fs::remove_file(&path).await.is_ok() {
                             deleted += 1;
+                            removed = true;
                             // Audited explicitly: this unlink bypasses
                             // verify_and_unlink, which has nothing to verify
                             // against here.
@@ -405,22 +430,39 @@ impl RecoverableJobHandler for ThumbDerivedImport {
                                 &path,
                             );
                         }
-                    } else {
-                        record_or_log(
-                            store,
-                            THUMB_DERIVED_IMPORT_JOB_NAME,
-                            "sidecar_source_gone",
-                            "anomaly",
-                            None,
-                            serde_json::json!({
-                                "path":        position,
-                                "source_hash": hash,
-                                "note": "source Blob no longer exists; the thumbnail is \
-                                         unimportable and is deleted on a repair run",
-                            }),
-                        )
-                        .await;
                     }
+                    // Recorded in BOTH modes. The finding used to be the
+                    // `else` of the deletion, so a repair run unlinked files
+                    // and reported a clean sweep — the audit stream held the
+                    // only trace, and the run drawer an operator actually
+                    // looks at said zero. A deletion is the outcome most
+                    // worth a finding, not least.
+                    record_or_log(
+                        store,
+                        THUMB_DERIVED_IMPORT_JOB_NAME,
+                        "sidecar_source_gone",
+                        // `anomaly` in both modes — it is what the panel
+                        // renders as "notices", and `detail.deleted` carries
+                        // whether the run left the sidecar alone or removed
+                        // it. A separate severity for the deleted case would
+                        // render identically and split one badge across two
+                        // values.
+                        "anomaly",
+                        None,
+                        serde_json::json!({
+                            "path":        position,
+                            "source_hash": hash,
+                            "deleted":     removed,
+                            "note": if removed {
+                                "source Blob no longer exists; sidecar was unimportable and \
+                                 has been deleted"
+                            } else {
+                                "source Blob no longer exists; the thumbnail is unimportable \
+                                 and is deleted on a repair run"
+                            },
+                        }),
+                    )
+                    .await;
                 } else {
                     let path = self.thumbnails_root.join(dir_name).join(&name);
                     match fs::read(&path).await {
@@ -553,7 +595,17 @@ impl RecoverableJobHandler for ThumbDerivedImport {
              {dead_source} skipped (source gone)"
         );
 
-        RunOutcome::completed()
+        // Surfaced on the run row, not just in the process log. A repair run
+        // that unlinks hundreds of files while reporting only a finding
+        // total tells an operator nothing about what it did with them.
+        RunOutcome::completed_with(serde_json::json!({
+            "imported":        imported,
+            "already_present": already,
+            "deleted":         deleted,
+            "unverified":      unverified,
+            "dead_source":     dead_source,
+            "failed":          failed,
+        }))
     }
 }
 

src/infrastructure/services/trash_cleanup_service.rs

@@ -6,7 +6,7 @@ use tracing::{debug, error, info, instrument};
 use crate::common::errors::Result;
 use crate::domain::repositories::trash_repository::TrashRepository;
 use crate::infrastructure::repositories::pg::trash_db_repository::TrashDbRepository;
-use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs};
+use crate::infrastructure::scheduler::{JobHandler, JobOutcome, JobRegistry, JobRunArgs, Mutates};
 use crate::infrastructure::services::dedup_service::DedupService;
 use async_trait::async_trait;
 
@@ -177,6 +177,17 @@ impl JobHandler for TrashCleanupService {
         Self::JOB_NAME
     }
 
+    fn description(&self) -> &'static str {
+        "Permanently deletes trashed items past the retention window, then \
+         runs a dedup GC sweep as its tail step to reclaim blobs the \
+         deletions dropped to zero references. This is the periodic tick \
+         that keeps storage bounded."
+    }
+
+    fn mutates(&self) -> Mutates {
+        Mutates::Always
+    }
+
     /// Runs one bulk-delete-expired + GC sweep. `count` on the returned
     /// `JobOutcome::Ok` is the total number of rows this tick removed
     /// from the trash (files + folders); `extra` carries GC reclaim