# Decision: Scaleway object storage as the open-weight reserve

**Date:** 2026-09-13  
**Status:** accepted  
**Affects:** `docs/backup-storage-policy.md`, `inventory/collection-policy.md`,
`docs/hardware-envelope.md`, `scripts/collect_model.py`, FI-WP-0004  
**Supersedes (storage backend only):**
`docs/decisions/2026-07-24-nas-strategic-reserve.md` § storage facility.
The **capability-first** rule from that decision stands.

---

## Decision

1. **Source of truth for weight blobs** is a dedicated Scaleway Object
   Storage bucket in `nl-ams`, operated as `reef-storage`, consumed by
   this repo. Git still holds catalog metadata only.

2. **VAULT HD** (`D:\vault\coulomb\freedom-intelligence\`) is **staging
   and optional local R-spine cache**. It is not the strategic envelope.

3. **Storage class follows tier:**
   - **R (runnable spine):** One Zone IA — cheap, GET is immediate.
   - **S (strategic):** Glacier — cheapest just-in-case; restore cost
     and latency are acceptable.
   - **W:** only with euro-budget headroom; One Zone IA or Glacier by size.

4. **Capacity gate is euros/month, not a 850 GiB disk quota.** The 850 /
   920 GiB numbers were a 1 TB NAS artifact. Usage-based object storage
   removes that wall. Soft infrastructure budget: **€15 / month**
   (ex VAT) for this bucket. Founder Scaleway billing alert remains the
   hard backstop (`RESOURCE-WP-0002`).

5. **Do not reuse** `railiance-platform-pg-backup`. That bucket expires
   objects at 30 days. Model weights must not.

---

## Why Scaleway (economics)

Org already selected Scaleway over Hetzner / Host Europe for S3
(`resource-control` RESOURCE-WP-0002, 2026-08-14). Same project, same
failure domain independence from Host Europe `railiance01`.

Prices from [Scaleway storage pricing](https://www.scaleway.com/en/pricing/storage/)
as of 2026-09-13, ex tax:

| Class | € / GB-month | 45 GiB (R spine) | 167 GiB (V4-Flash) | 1454 GiB (Kimi K3) |
| ----- | -----------: | ---------------: | -----------------: | -----------------: |
| Multi-AZ Standard | ~0.0146 | €0.66 | €2.44 | €21.23 |
| One Zone IA | ~0.012 | €0.54 | €2.00 | €17.45 |
| Glacier | ~0.00254 | €0.11 | €0.42 | **€3.69** |

Glacier restore to Standard is €0.009/GB (V4-Flash restore ≈ €1.50;
K3 restore ≈ €13). Ingress is included. Egress is 75 GB/month free,
then €0.01/GB — relevant when we actually pull a giant to a GPU host,
not when we park it.

**Portfolio that the 850 GiB NAS could not hold:**

| Item | Class | Est. monthly |
| ---- | ----- | -----------: |
| R-spine resident (One Zone IA) | R | €0.54 |
| DeepSeek-V4-Flash-0731 (Glacier) | S | €0.42 |
| Kimi K3 official tree (Glacier) | S | €3.69 |
| **Total** | | **~€4.65** |

That is inside the €15 soft budget with room for a second compressed
giant or a Qwen3.8-27B R upgrade. Buying another multi-TB disk to
fit K3 would spend the same money in a year and stay on the
workstation failure domain.

VAULT remains useful: sequential staging for `huggingface_hub`
downloads, and a local copy of the R-spine if the workstation is
doing inference. It is no longer the thing INTENT means by “reserve.”

---

## Bucket contract

| Field | Value |
| ----- | ----- |
| Provider | Scaleway Object Storage |
| Region | `nl-ams` |
| Endpoint | `https://s3.nl-ams.scw.cloud` |
| Bucket (planned) | `railiance-fi-open-weight-reserve` |
| Reef attributes | `reef-storage/substrate/object-stores/fi-open-weight-reserve.yaml` |
| Public access | disabled |
| Versioning | on |
| Object expiry | **none** |
| Lifecycle | `strategic/` → Glacier after **90 days** (Scaleway minimum). S-tier PUT uses `StorageClass=GLACIER` immediately. |
| Encryption | provider-managed at rest |
| Identity | bucket-scoped key, not the postgres backup key |
| Secrets | `railiance-platform` / OpenBao — never this git repo |

### Prefix layout

```text
s3://railiance-fi-open-weight-reserve/
├── models/{org}__{name}/{revision}/     # R / W  (One Zone IA at PUT)
├── strategic/{org}__{name}/{revision}/  # S      (Glacier via lifecycle)
├── companions/
├── staging/                             # incomplete uploads; purge after 14d
└── manifests/{org}__{name}/{revision}/MANIFEST.json
```

Each prefix maps to one catalog YAML. `collection.storage_path` is the
`s3://` URI, not a VAULT path.

---

## What stays from 2026-07-24

- Run envelope ≠ reserve envelope.
- License and integrity first.
- Catalog in git, blobs off git.
- No public mirror, no closed weights.
- R-spine always kept; S is a small number of top open identities.

## What changes

| Before | After |
| ------ | ----- |
| Facility = workstation VAULT HD | Facility = Scaleway `nl-ams` |
| Soft quota 850 GiB | Soft budget €15/month |
| K3 deferred on capacity | K3 economically in-scope on Glacier |
| V4-Flash uncollectable-as-12B | V4-Flash (~167 GiB MIT MoE) is the first S pull |

---

## Follow-ups

- [x] FI-WP-0004-T01 this file
- [ ] FI-WP-0004-T08 operator creates the bucket
- [ ] FI-WP-0004-T09 first collect: DeepSeek-V4-Flash-0731
- [ ] resource-control inventory record (optional; FI consumes, resource-control costs)