Verify full and essentials recovery and implement bounded retention tooling

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/backup-storage-tiers.md

@@ -90,3 +90,57 @@ when overlap/headroom cannot be met. Never delete the last verified recovery poi
    upload overlap, failed-upload preservation and safe expiration within 10 GiB.
 6. Switch scheduled secondary delivery only after these gates pass. Preserve the
    current good full Nextcloud copy until a verified replacement permits retirement.
+
+## Verified implementation — 2026-09-06
+
+The actual encrypted essentials artifact is **286,298,520 bytes (273 MiB)**,
+versus 5,353,024,293 bytes for the tested full archive: about 94.7% smaller.
+Nine distinct copies at this measured size need about 2.40 GiB, before other
+services, incoming overlap, growth and provider accounting. Keep the 600 MiB
+admission ceiling; current size is not a perpetual promise.
+
+The full archive was multipart-uploaded to the separate existing-policy prefix
+`platform-pg/application-archives/forgejo/`, retrieved by its returned object
+version, hash-checked, decrypted and restored successfully. Forgejo startup,
+two Git clones/fsck and all 2,040 package blob hashes passed. This is a verified
+primary archive and recovery; recurring full-archive scheduling is still pending.
+The existing bucket contract is versioned with 30-day current/noncurrent lifecycle;
+a separate calendar archive-expiration policy has not been activated.
+
+The smaller candidate was uploaded/downloaded through Backup, decrypted and
+restored without primary access. Forgejo started with 142 repositories, six users
+and 2,050 package metadata records; the package service was explicitly disabled.
+Two Git clones/fsck passed. The newer essentials capture and older full archive
+are different recovery points; they are not claimed to be an atomic matching pair.
+Both disposable recovery environments were removed. The public pinned Forgejo
+and PostgreSQL recovery images were successfully pulled independently of both
+Scaleway and the production forge. Other five database clusters total about
+209 MiB of physical data; compressed export budgets remain to be measured.
+
+Implementation:
+
+- `scripts/capture_forgejo_archive.py --profile essentials` uses native exclusions,
+  seals the explicit manifest and enforces the size ceiling. Default remains full.
+- `scripts/forgejo_essentials_profile.py` also removes generated Actions logs while
+  preserving unique attachments/LFS/Actions artifacts and rejects unsafe paths.
+- `scripts/scaleway_forgejo_archive.py` performs bounded multipart PUT, aborts failed
+  in-flight multipart uploads, then downloads and verifies bytes. Run with
+  `uv run --no-project --with boto3==1.40.18 python ...`; credential values stay in
+  captured memory from the existing governed databases Secret.
+- `scripts/backup_retention_plan.py` selects seven daily/two weekly points without
+  duplicate uploads; protects the explicitly pinned recovered archive and newest
+  point, ignores unknown/unverified objects and requires 2 GiB upload headroom.
+- `scripts/execute_nextcloud_retention.py` previews by default. With `--apply`, the
+  separate attended owner executor revalidates protected ciphertext, retained
+  object presence and candidate sizes/ETags before conditional deletion. It uses
+  a per-user local lock; deploy only one authoritative owner executor. It never
+  changes workload credentials or deletes full archives. Unknown drill filenames
+  are intentionally ineligible. No live expiration was executed in this review.
+
+Before scheduled cutover, bind the durable primary caller and dependencies,
+produce canonical `forgejo-essentials-YYYYMMDDTHHMMSSZ.zip.age` names and verified
+inventory, and bind the separate owner retention execution/fresh quota check.
+The current local `forgejo-backup` cron remains unchanged. The activity-core
+worker has vendored age/kubectl, which its CNPG resolver adds to PATH; absence
+from its default PATH did not establish missing tools. Neither that mount nor
+an attended workstation proof establishes a scheduled primary archive job.