Record round-3 attended-window choices (backup prefixes, coulomb-social backup, drill owner)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/decisions/2026-10-11-security-unblock-decisions.md

@@ -87,3 +87,22 @@ not decisions.
   restore/restart drill receipt and expired retention windows.**
 - The State Hub primary stop and the core-hub cutover follow the standing change rule.
 - Hall of Helix publication is not covered. It stays with consent decision `8a095daa`.
+
+## Round 3 — attended-window choices (2026-10-11)
+
+- **C1, RPF-WP-0038-T04, Forgejo primary backup:** prefix
+  `s3://railiance-platform-pg-backup/platform-pg/application-archives/forgejo/` (same bucket contract
+  as coulomb-social, Standard Multi-AZ nl-ams). Retention is 7 daily + 4 weekly + 3 monthly full
+  archives through bucket lifecycle, never deleting the newest good archive. Nextcloud becomes the
+  essentials-only secondary (about 273 MiB) within the 10 GiB budget. The worker gets a prefix-scoped
+  credential.
+- **C2, RPF-WP-0053-T02/T03, coulomb-social paired backup:** approved as proposed. A new
+  prefix-scoped Scaleway IAM credential (write and version-read under
+  `application-archives/coulomb-social/` only) is delivered to `/etc/coulomb-social-backup/primary.env`
+  (0600, parent 0700). Schedule: daily 03:15 UTC (+5 min jitter), RPO 24 h, stale alarm 26 h,
+  provisional RTO 60 min. Acceptance needs the independent retrieve + restore comparison.
+- **C4, NK-WP-0022-T08 drill:** the railiance01 restore/restart drill is blue-lane. Sol prepares and
+  runs it. The approved D4 deletion batch goes into the attended window only once a passing drill
+  receipt exists.
+- **USER-WP-0035-T02** was not a founder choice. The mail lane exists (EMAIL-WP-0004). The remaining
+  work is user-engine's setup-link delivery handoff, so it was returned to the owner.