diff --git a/.env.example b/.env.example
index 3c02cfbec..31cee47cc 100644
--- a/.env.example
+++ b/.env.example
@@ -207,12 +207,20 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # the backup silently. The backup runs at 02:30 Europe/Berlin via pg-boss cron.
 # Restore with `pnpm tsx scripts/restore-backup.ts <userId> <YYYY-MM-DD>`.
 # See docs/ops/backup-restore.md for the format spec + step-by-step.
+#
+# The worker never deletes a BACKUP object -- its grant is PutObject, GetObject
+# and AbortMultipartUpload -- so BACKUP_RETENTION_DAYS is the number you set
+# the bucket's own lifecycle rule to, not something the worker enforces. The
+# one key it does delete is its own connection test's `_healthcheck/<ts>.bin`,
+# and that delete is best-effort: without DeleteObject on that prefix every
+# Test-connection press leaves one 1-byte orphan behind, silently.
+#
 # BACKUP_S3_ENDPOINT="https://<account>.r2.cloudflarestorage.com"
 # BACKUP_S3_BUCKET="healthlog-backups"
 # BACKUP_S3_ACCESS_KEY=""
 # BACKUP_S3_SECRET_KEY=""
 # BACKUP_S3_REGION="auto"           # "auto" for Cloudflare R2; real region for AWS S3
-# BACKUP_RETENTION_DAYS="30"        # objects older than this are pruned (best-effort; prefer a bucket lifecycle rule)
+# BACKUP_RETENTION_DAYS="30"        # the number for your bucket lifecycle rule (see above)
 # BACKUP_ENCRYPTION_KEY=""          # 64-hex-char or base64 32-byte; SEPARATE from ENCRYPTION_KEY
 
 
diff --git a/.env.production.example b/.env.production.example
index 4a56a53b6..27486de2b 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -315,9 +315,12 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # BACKUP_S3_REGION="auto"
 #
 # How long backup objects are meant to live, in days. Default 30, minimum 1.
-# The worker never deletes an object -- its grant is PutObject, GetObject and
-# AbortMultipartUpload -- so this number is what you set the bucket's own
-# lifecycle rule to. See docs/ops/backup-restore.md.
+# The worker never deletes a BACKUP object -- its grant is PutObject, GetObject
+# and AbortMultipartUpload -- so this number is what you set the bucket's own
+# lifecycle rule to. The one key it does delete is its own connection test's
+# `_healthcheck/<ts>.bin`, and that delete is best-effort: without DeleteObject
+# on that prefix every Test-connection press leaves one 1-byte orphan behind,
+# silently. See docs/ops/backup-restore.md.
 # BACKUP_RETENTION_DAYS="30"