Add documented KoKonna failure policy, bounded retries and durable recovery escalation [skip ci]

pigway_frame_flow/display/upload_reconciliation.py

@@ -59,6 +59,12 @@ class UploadReconciliation:
                     candidates.append(image)
             # Ambiguous matches never release a write lock.
             if len(candidates) != 1:
+                service.recovery.observe(
+                    op,
+                    "gallery_match_missing"
+                    if not candidates
+                    else "gallery_match_ambiguous",
+                )
                 return None
             expected = candidates[0].image_id
             data = driver.download(expected)
@@ -66,6 +72,7 @@ class UploadReconciliation:
                 len(data) != intent["size"]
                 or hashlib.sha256(data).hexdigest() != intent["sha256"]
             ):
+                service.recovery.observe(op, "content_mismatch")
                 return None
             result["image_id"] = expected
             result["upload_confirmed"] = True