fix(tier): avoid re-fencing published mutations (#7274)

docs/architecture/ilm-tiering-persistence-contracts.md

@@ -168,6 +168,8 @@ New intents use a 15-minute expiry. A peer-only terminal tombstone is retained u
 
 The coordinator creates its durable record and peer `Prepare` blocks new reference creation, drains exact tier-operation leases, and proves that edit/remove/clear will not strand authoritative references. Prepare, Commit, and Abort use all-node fanout rather than quorum: independent peer calls use a work-conserving concurrency limit of four, a 30-second per-peer deadline, and a 30-second fanout-wide deadline; Prepare is additionally capped by the intent expiry. The coordinator collects every completed outcome. A timed-out or otherwise ambiguous started Prepare is included in compensating Abort because cancellation does not prove the peer failed to persist its fence; peers not started before the fanout deadline make Prepare fail but do not require Abort. The coordinator then conditionally writes tier config, durably commits the coordinator intent, releases its exclusive guards, requires every prepared peer to commit, publishes the runtime candidate, and clears the block. Per-mutation sharded mutexes serialize local phases only; persisted intent plus tier-config ETag is authoritative.
 
+Terminal recovery does not reinstall a process-local operation fence when the published in-memory manager has the exact committed candidate digest. This exception affects only ordinary tier-operation leases: recovery still replays peer `Commit`, retains and conditionally cleans the durable evidence, and blocks a new tier configuration mutation until the recovery snapshot is quiescent. A different local digest remains fenced until the committed candidate is safely published.
+
 ### Recovery decisions
 
 | Observed durable state/input | Unique current owner | Current recovery decision | Destructive/config admission |