## C3 — retention poisoning. An attacker holding ONLY the forced key + the repo password ADDS snapshots (allowed) dated in the future, same host+tag.
real snapshots before:
ID        Time                 Host        Tags        Paths
--------------------------------------------------------------
63a075dc  2026-10-03 09:07:50  labbox      app1        /d/tree
066a039d  2026-10-03 09:07:52  labbox      app1        /d/tree
16f27a03  2026-10-03 09:12:18  labbox      app1        /d/tree
--------------------------------------------------------------
3 snapshots
after the attacker's adds (forced key, all succeeded):
ID        Time                 Host    Tags
---------------------------------------------
63a075dc  2026-10-03 09:07:50  labbox  app1
066a039d  2026-10-03 09:07:52  labbox  app1
16f27a03  2026-10-03 09:12:18  labbox  app1
cf04458a  2027-01-01 03:00:00  labbox  app1
19394898  2027-01-02 03:00:00  labbox  app1
bfaf4619  2027-01-03 03:00:00  labbox  app1
3ba72ec1  2027-01-04 03:00:00  labbox  app1
8b3b6385  2027-01-05 03:00:00  labbox  app1
7034c9da  2027-01-06 03:00:00  labbox  app1
2c18c893  2027-01-07 03:00:00  labbox  app1
f0caba56  2027-02-15 03:00:00  labbox  app1
cb7c4ec4  2027-03-15 03:00:00  labbox  app1
064066cf  2027-04-15 03:00:00  labbox  app1
bc83265e  2027-05-15 03:00:00  labbox  app1
af39799e  2027-06-15 03:00:00  labbox  app1
e887befe  2027-07-15 03:00:00  labbox  app1
---------------------------------------------
16 snapshots
## the HONEST retention (the box's exact policy) run later by whoever holds a deleting key — DRY RUN:
Applying Policy: keep 7 daily, 4 weekly, 6 monthly snapshots
keep 7 snapshots:
ID        Time                 Host        Tags        Reasons           Paths
---------------------------------------------------------------------------------
2c18c893  2027-01-07 03:00:00  labbox      app1        daily snapshot    /d/empty
f0caba56  2027-02-15 03:00:00  labbox      app1        daily snapshot    /d/empty
                                                       monthly snapshot
cb7c4ec4  2027-03-15 03:00:00  labbox      app1        daily snapshot    /d/empty
                                                       monthly snapshot
064066cf  2027-04-15 03:00:00  labbox      app1        daily snapshot    /d/empty
                                                       weekly snapshot
                                                       monthly snapshot
bc83265e  2027-05-15 03:00:00  labbox      app1        daily snapshot    /d/empty
                                                       weekly snapshot
                                                       monthly snapshot
af39799e  2027-06-15 03:00:00  labbox      app1        daily snapshot    /d/empty
                                                       weekly snapshot
                                                       monthly snapshot
e887befe  2027-07-15 03:00:00  labbox      app1        daily snapshot    /d/empty
                                                       weekly snapshot
                                                       monthly snapshot
---------------------------------------------------------------------------------
7 snapshots

remove 9 snapshots:
ID        Time                 Host        Tags        Paths
---------------------------------------------------------------
63a075dc  2026-10-03 09:07:50  labbox      app1        /d/tree
066a039d  2026-10-03 09:07:52  labbox      app1        /d/tree
16f27a03  2026-10-03 09:12:18  labbox      app1        /d/tree
cf04458a  2027-01-01 03:00:00  labbox      app1        /d/empty
19394898  2027-01-02 03:00:00  labbox      app1        /d/empty
bfaf4619  2027-01-03 03:00:00  labbox      app1        /d/empty
3ba72ec1  2027-01-04 03:00:00  labbox      app1        /d/empty
8b3b6385  2027-01-05 03:00:00  labbox      app1        /d/empty
7034c9da  2027-01-06 03:00:00  labbox      app1        /d/empty
---------------------------------------------------------------
9 snapshots

Would have removed the following snapshots:
{066a039d 16f27a03 19394898 3ba72ec1 63a075dc 7034c9da 8b3b6385 bfaf4619 cf04458a}

