Its stateless from the customer's perspective since they don't have to manage the consensus layer (which is only possible because we separated data from metadata).

Obviously there is state somewhere since the cluster is storing data, its just offloaded to S3 + our control plane, while still keeping all the data in the customer's cloud account.

I think you should write some detailed docs about your design and consistency guarantees.