fix(audit): fermer les frontieres restantes

docs/deployment.md

@@ -282,11 +282,11 @@ have sent new contracts to a new tree and made the existing ones unreadable
 `logs/` and `backups/` were built from `os.getcwd()` too (OBS-006), and the
 backup script kept its own copy of the document path — so it archived
 `./documents` no matter what `DOCUMENTS_ROOT` said. Following prerequisite 2
-was therefore enough, on its own, to make every contract backup empty; the
-script prints `No documents directory…` and still exits 0, so a scheduled
-task watching the exit code would have seen green indefinitely. All three
-roots now come from `app/storage.py`, and the backup run prints the document
-source it used.
+was therefore enough, on its own, to make every contract backup empty. All
+three roots now come from `app/storage.py`, and the backup run prints the
+document source it used. A missing or unarchivable document store makes the
+run exit non-zero even when the database dump itself is valid, so a scheduler
+cannot report a database-only recovery point as a complete backup.
 
 **After setting `DOCUMENTS_ROOT` on the node, run the backup once by hand**
 and check the `Document source:` line and the size of the resulting
@@ -327,4 +327,4 @@ Monitor these logs regularly for suspicious activity.
 - Run `python security_scan.py` after any configuration changes
 - Test backup restoration quarterly
 - Review and rotate `SECRET_KEY` if compromised
-- Keep Python and system packages updated
+- Keep Python and system packages updated