What the vault can read, said where the question gets asked

Every upload is kept twice: the file exactly as it arrived, and a

plain-text rendering the vault can search. Both are encrypted under the

same key, both belong to the same compartments, and deleting the document

deletes both — there is no state in which one survives the other. The

rendering is what makes a document findable; the original is what makes

it defensible, because a conversion that read something badly can be run

again against the file it read.

Conversion quality is not a yes-or-no question, so the vault records one

of three verdicts and shows which one a document got. A format it

converts badly is never presented as converted: a converter that silently

mangles a format produces confident wrong answers out of retrieval, and

declining to convert produces a clear message.

The published matrix is generated from the same table the upload pipeline

dispatches against, so it cannot describe a vault other than this one.

That is the whole point: a page telling somebody "we read that" while the

vault refuses their file is the version of a stale claim with a person on

the other end of it.