Activate FI open-weight reserve bucket on Scaleway

Bucket railiance-fi-open-weight-reserve is live in nl-ams: versioning
on, no expiry, strategic/ Glacier after 90 days (provider minimum).
S-tier PUT uses Glacier immediately. Scoped IAM key still residual.

Assistant: grok
Assistant-Session: 01a09c6a-1cfc-75b1-a78d-c13eaf22241d

bindings/consumers.yaml

@@ -21,8 +21,14 @@ consumers_actual:
     evidence:
       - repo: resource-control
         path: docs/evidence/RESOURCE-WP-0002-T05-restore-2026-08-14.md
+  - consumer_id: freedom-intelligence
+    resource_id: resource:agents:fi-open-weight-reserve
+    readiness_state: bucket-live
+    evidence:
+      - repo: reef-storage
+        path: substrate/object-stores/fi-open-weight-reserve.yaml
 notes:
   - Actual consumer is recorded only after WAL flows (RESOURCE-WP-0002-T05).
   - rapp-postgres consumes a reviewed destination; it does not procure the bucket.
-  - freedom-intelligence is a potential consumer until FI-WP-0004-T08 creates the bucket.
+  - freedom-intelligence bucket is live (FI-WP-0004-T08); first collect is T09.
   - Do not put model weights in railiance-platform-pg-backup (30-day expiry).

substrate/object-stores/fi-open-weight-reserve.yaml

@@ -1,16 +1,16 @@
-# Planned attributes for FI-WP-0004. No secrets in this file.
+# Live attributes for FI-WP-0004. No secrets in this file.
 # Do NOT copy the postgres backup 30-day expiry onto this bucket.
 schema_version: "0.1"
 resource_id: resource:agents:fi-open-weight-reserve
 provider: Scaleway
 product: onezone-ia-plus-glacier
-status: planned
+status: active
 endpoint: https://s3.nl-ams.scw.cloud
 region: nl-ams
 bucket: railiance-fi-open-weight-reserve
 prefix: ""
 versioning: true
-lifecycle: "no object expiry; prefix strategic/ → Glacier after 1 day"
+lifecycle: "no object expiry; prefix strategic/ → Glacier after 90 days (Scaleway minimum). S-tier PUT uses StorageClass=GLACIER immediately."
 provider_project_ref: e1a0dd0e-04b8-4ea9-8b30-d53f8c35c688
 intended:
   public_access: disabled
@@ -26,5 +26,8 @@ notes:
   - "Decision: freedom-intelligence/docs/decisions/2026-09-13-scaleway-object-reserve.md"
   - "Soft budget EUR 15/month. Founder Scaleway billing alert is the hard backstop."
   - "NEVER apply the 30-day expiry used on railiance-platform-pg-backup."
-  - "Bucket create is FI-WP-0004-T08 (operator). This file stays planned until then."
+  - "Bucket created 2026-09-13. Versioning on. No object expiry."
+  - "Lifecycle: strategic/ Glacier after 90 days (Scaleway minimum). S-tier PUT uses StorageClass=GLACIER immediately."
+  - "Smoke 2026-09-13: STANDARD PUT/GET ok; Glacier PUT ok; Glacier GET is InvalidObjectState until restore (expected)."
+  - "Scoped IAM application key not yet created: bootstrap key can create buckets but cannot list IAM applications. Collect uses bootstrap via OpenBao at runtime until a founder-made bucket-scoped key lands at platform/workloads/railiance/freedom-intelligence/object-storage."
   - "resource-control may later cite reef:storage/substrate/object-stores/fi-open-weight-reserve.yaml"

tools/create-fi-open-weight-reserve-bucket.sh

@@ -66,7 +66,7 @@ else
   scw object bucket create "$BUCKET" region="$REGION" acl=private enable-versioning=true -o json
 fi
 
-echo "applying lifecycle: strategic/ → Glacier after 1 day; no expiry"
+echo "applying lifecycle: strategic/ → Glacier after 90 days (Scaleway minimum); no expiry"
 VENV="${TMPDIR:-/tmp}/reef-storage-boto3"
 if [[ ! -x "$VENV/bin/python" ]]; then
   python3 -m venv "$VENV"
@@ -91,7 +91,7 @@ client.put_bucket_lifecycle_configuration(
                 "ID": "strategic-to-glacier",
                 "Status": "Enabled",
                 "Filter": {"Prefix": "strategic/"},
-                "Transitions": [{"Days": 1, "StorageClass": "GLACIER"}],
+                "Transitions": [{"Days": 90, "StorageClass": "GLACIER"}],
             },
             {
                 "ID": "staging-abort-incomplete",