feat: WP-0002 T03 selection decision, wait on purchase

Recommend Scaleway Multi-AZ nl-ams. Inventory stays proposed with
description, decision, reef: refs, secret: handle, and consumers.
Human approval required before ordered.

docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md

@@ -0,0 +1,82 @@
+# RESOURCE-WP-0002 T03 — primary object-store selection
+
+Date: 2026-08-14  
+Status: **recommended — awaiting human purchase approval**  
+Resource: `resource:platform:audit-storage`  
+Procuring / consuming entity: `entity:railiance` (self-use, no 20 % markup)  
+Operating reef: `reef-storage` (not `reef-railiance`)
+
+This is the decision record T03 asked for. It is not a purchase. It does
+not create a Scaleway account, bucket, or key.
+
+## Recommendation
+
+| Role | Choice | Why |
+| --- | --- | --- |
+| **Primary** | Scaleway Object Storage, Standard Multi-AZ, region `nl-ams` (NL, EU) | Only A/B/C candidate that is orderable, S3/SigV4 documented, Multi-AZ, published durability, **managed encryption at rest**, and an independent failure domain from Host Europe `railiance01`. Lowest comparable 320 GB running cost among managed options that meet acceptance. |
+| **Independent secondary copy** | Host Europe Backup Storage (SFTP/SCP) or the existing governed Nextcloud lane (T06) | Not S3; not a Barman primary. Keeps a second copy off Scaleway and off the same API credential. |
+
+Do **not** put the primary bucket on `reef-railiance`. S3 is a
+provider-delegated capability; `reef-storage` is the substrate.
+
+## Ranking (A / B / C)
+
+Evidence: demand/cost model 2026-08-10, expanded comparison 2026-08-10,
+due diligence 2026-08-10. Labor €60/h. Tax excluded. Running totals at
+the normalized 320 GB + 5 GB restore-drill point.
+
+| Criterion | A Host Europe Cloud Storage | B Scaleway Multi-AZ `nl-ams` | C Hetzner Object Storage |
+| --- | --- | --- | --- |
+| Total cost (320 GB) | unknown (no current S3 quote) | **€65.14**/mo (€5.14 infra + €60 labor) | €96.49/mo (€6.49 min + €90 labor) |
+| Compatibility (CNPG/Barman S3) | unknown / not orderable on evidence | documented S3 + SigV4; live preflight still required | documented S3; live preflight still required |
+| Resilience | same provider as compute | **different provider**; Multi-AZ; 99.999999999% durability claim | different provider; no quantified storage SLA |
+| Sovereignty | DE if it existed | NL / EU | DE / EU |
+| Operational effort | unknown | 1 h/mo planned; no rail to run | 1.5 h/mo; SSE-C custody if we accept no default at-rest encryption |
+| Exit cost | unknown | egress €0.01/GB after 75 GB free + 4 h labor | inside 1 TB included until quota exceeded |
+| Blocking gap | current S3 **not confirmed orderable** | live Barman preflight; contract/tax on the paying account | **no default at-rest encryption** (SSE-C only) |
+
+Self-managed Garage on 2–3 VMs is €240–€336/mo at 320 GB and fails closed
+before month-12 base volume. It is not a primary candidate at this
+workload.
+
+## What we are buying (if approved)
+
+- Product: Scaleway Standard Multi-AZ Object Storage  
+- Region: `nl-ams`  
+- Commitment: **none** (usage-based)  
+- Payer: Railiance (`entity:railiance`); transfer price = delivered cost  
+- Public access: disabled  
+- Identity: narrowest key, bucket/prefix only  
+- Versioning: on  
+- Lifecycle: 30-day recovery window (match demand)  
+- Cost alert: on the Scaleway project  
+- Owner in inventory: `resource-control`  
+- Attribute home: `reef-storage/substrate/object-stores/platform-audit-storage.yaml`  
+- Credential home (after T04): `secret:railiance-platform/platform-pg-backup-s3`  
+- Consumer potential: `rapp-postgres`  
+- Consumer actual: none until WAL flows  
+
+## What human financial authority must approve
+
+1. Create or reuse a Scaleway project paid as Railiance (or GmbH Hauptkonto
+   until the Railiance account exists).  
+2. Accept Scaleway’s contract/tax treatment for that account.  
+3. Accept that Host Europe S3 stays out of the race until written
+   orderability exists.  
+4. Accept Hetzner only as a price comparator unless SSE-C custody is
+   explicitly chosen later.  
+5. Spend: expected **~€3–€10/mo infrastructure** at current size, plus
+   ~1 h operator labor; not a committed term.
+
+After **yes**: create private bucket, scoped key, versioning/lifecycle,
+cost alert; fill `reef-storage` attributes (endpoint, bucket, prefix,
+project ref); flip inventory `proposed → ordered`; then T04/T05.
+
+After **no**: write the rejection on this record; do not invent another
+primary without a new decision.
+
+## Authority
+
+Recommended by: resource-control (this file)  
+Approved by: _vacant — human financial authority_  
+Approved on: _null_