Document history-backed datetime search-attribute recovery #399

Current state: delivered in English and all seven translations through PR #400, merged at 5e239cdc39dad1c866656b4e38fea1c6a72073cb. Normal published Workflow 2.12.0 at 789f3b6428db91590edfb45fc6da717113a61ee4, Packagist source/dist identity and actual installed repair-command acceptance are verified. Pages run 40008026090 passes. At 20:35 UTC October 23, all eight live search-attribute guides return HTTP 200 with the correct language, the 2.12.0 floor and the exact repair/apply/namespace commands. Seven source hashes and executable blocks match English. This closes the documentation delivery only; Core #898 and its next Server image/HTTP acceptance remain separate.

Existing datetime search-attribute projections can contain an offset’s wall time rather than the original instant. Upgrading a writer does not prove that old derived rows are correct. Operators need a history-backed, preview-first repair procedure that refuses unverifiable data.

Product review: this is the Website follow-through for the product correction and additive recovery command in Workflow #898 / PR #914, merged at b3bbfdb5258c68546ae38ca1fde52818e4b05d12. Workflow 2.12.0 is now published and its normal installed repair-command acceptance passes. Documentation does not complete the product requirement or its separate Server visibility-query/image adoption.

Acceptance:

• Prepare English and all seven translated search-attribute guides, identical commands and seven reviewed-source hashes. Keep the PR in draft until the final actual package contract, registry identity and installed receipt arrive.
• Use the exact public workflow:v2:repair-search-datetimes RUN_ID contract: preview by default, explicit --apply, optional exact non-empty --namespace, repeated --key, optional --json.
• Back up the workflow database and upgrade all writers first. Inspect the exact run/key selection and would_repair, apply the same selection, then verify readback/repeat reports. Never infer a timezone from a stored wall time.
• Require the latest retained explicitly typed upsert and matching original logical sequence. Pruned/missing/stale/timezone-ambiguous evidence, wrong namespace or a no-longer-datetime selected key refuses. One unprovable key refuses the entire selection.
• Explain that only derived search attributes and their run summary change transactionally; authoritative history, business commands, run/task identities and leases are unchanged. Unexpected storage errors report unverified; inspect before retrying because an uncertain commit is not a guaranteed rollback.
• Keep runtime and Server image adoption unreleased until separately qualified. The Core command does not repair the separate Server visibility-query binding path or restore pruned history.
• Publish all eight together only after the final package gate; exact checks/Sonar, actual Pages and eight live readback precede Website closure. Core #898 closure stays with its product owner.

Canonical public source: recovery documentation, command signature and outcomes. Existing accepted Website work continues independently; this is a publication gate, not a source hold.