diff --git a/docs/INSTAGRAM_IMAGE_PIPELINE.md b/docs/INSTAGRAM_IMAGE_PIPELINE.md
index 2a41364..5fc3055 100644
--- a/docs/INSTAGRAM_IMAGE_PIPELINE.md
+++ b/docs/INSTAGRAM_IMAGE_PIPELINE.md
@@ -56,6 +56,29 @@ Required in the Worker runtime:
 `CLOUDINARY_UPLOAD_PRESET` is supported for unsigned upload mode, but signed
 uploads using API key and secret are preferred for production.
 
+## OpenClaw generated-media delivery proxy
+
+The narrowly scoped Supabase Edge Function is canonically owned by the
+`relay-live-business-engagement-connector` repository at
+`supabase/functions/cloudinary-upload-proxy/index.ts`. It belongs to the
+OpenClaw campaign-delivery lane rather than this tenant queue worker.
+
+Its contract is intentionally smaller than the normal Cloudinary module:
+
+- one authenticated `POST` containing PNG or JPEG bytes;
+- public IDs must remain beneath `tailwagging-generated/`;
+- the caller-provided SHA-256 must match the received bytes;
+- Cloudinary overwrite and unique-name mutation are disabled;
+- the function downloads the resulting HTTPS asset and verifies its SHA-256;
+- the OpenClaw caller performs a second independent delivery checksum;
+- no list, search, transform, rename, update, archive, delete, or social action
+  is exposed.
+
+Host-specific deployment remains owned by the private `openclaw-ops`
+repository through `scripts/deploy-cloudinary-upload-proxy.mjs`. This
+repository neither owns nor deploys that function, and it must not acquire a
+second copy of either component.
+
 `OPENAI_IMAGE_TIMEOUT_MS` is deliberately separate from `HTTP_TIMEOUT_MS` so
 image generation can take longer than normal API calls without waiting forever.
 Do not remove the timeout completely.
diff --git a/docs/PRODUCTION_RUNTIME.md b/docs/PRODUCTION_RUNTIME.md
index dd82bfa..4ef2e45 100644
--- a/docs/PRODUCTION_RUNTIME.md
+++ b/docs/PRODUCTION_RUNTIME.md
@@ -22,6 +22,9 @@ Worker uses the service-role key only in the trusted Worker runtime.
 
 - Local mode uses SQLite files under `APP_DATA_DIR` for queue, history, source,
   angle, platform state, and local control-plane state.
+- Any host-local runtime must set `APP_DATA_DIR` to a protected path outside
+  the Git checkout. The repository-local `data/` fallback is for disposable
+  development only and must not become a service-owned production path.
 - Production mode uses Supabase for `profiles`, `user_credentials`,
   `user_sources`, `user_settings`, `source_records`, `angle_records`,
   `queue_items`, `publish_history`, `worker_logs`, and `agent_jobs`.