Safety checks belong in the data path.
Data Convoy workers copy in S3, verify integrity, and only then remove a production source when an authorized operator has explicitly requested it.
Preview both directions
Archive and restore dry runs crawl the requested scope and report object counts and bytes. Archive previews apply the same exclusions as execution; restore previews do not issue rehydration requests.
Checksum first, size fallback
Archive, backup, and restore compare checksums when usable checksum metadata is present. If AWS cannot supply a comparable checksum, the worker verifies object size before reporting success.
Partial work cannot masquerade as success
Object-level failures are collected so one bad key does not erase useful progress, but any failure makes the overall job fail. Operators see failed items and can use bounded retry/cancel controls.
Your buckets. Your workers. Your control.