Stage uploads before accepting HTTP runs

docs/operations.md

@@ -71,9 +71,9 @@ go run ./cmd/distributor validate --config examples/local-publish.yml --pipeline
 ## HTTP Upload Workflow
 
 `distributor serve` runs the HTTP upload API for pipelines whose source backend
-is `http_upload`. Each upload token maps to one configured pipeline, and each
-accepted archive is staged, validated, and published through the same
-destination fan-out path used by local source runs.
+is `http_upload`. Each upload token maps to one configured pipeline. A valid
+archive is staged and validated before a run id is returned, then published
+through the same destination fan-out path used by local source runs.
 
 Minimal local HTTP upload configuration:
 
@@ -119,7 +119,7 @@ curl -X POST http://127.0.0.1:8080/upload \
   --data-binary @bundle.tar.gz
 ```
 
-Successful admission returns a run id:
+Successful staging and admission returns a run id:
 
 ```json
 {"run_id":"reports.20260603T120000Z.abcdef12","status":"accepted"}
@@ -136,6 +136,9 @@ or error details on failure. Status is memory-only and expires after
 `server.http.retention`; completed staged bundle directories are removed on
 expiry. Restarting the process clears upload status and queue state.
 
+Malformed archives and invalid source bundles are rejected by `POST /upload`
+before a run id is issued.
+
 Use `GET /healthz` for readiness after config and tokens load:
 
 ```sh