R-1295 live on hub rc.1 (a fresh Tester4 install set up its whole-guest off-site tier; the box consumed the credential and made its first copy); R-1294 read: an honest plan the cap can never catch up with (D54); R-1291 design (08 §10, D53); design lines for R-1295, R-1285, R-1292, R-1294; R-1296 filed; STATUS.

documentation/audits/r1294-offsite-cap-2026-10-26/README.md

@@ -0,0 +1,30 @@
+# R-1294 — demo-hp's weekly off-site clean-up refused by its own cap (read only, 2026-10-26)
+
+## The rule (code)
+
+- Controller `internal/backup/offbox_window.go:132` `offsiteGuard`: refuses a future-dated snapshot, a snapshot newer
+  than the hub allows, a removal younger than `keepDaily` (7) calendar days unless superseded the same day (R-824/R-867),
+  and **a plan larger than `maxRemove`** (`:152`). The policy: keep-daily 7, keep-weekly 4, keep-monthly 6, grouped by
+  host+tags (`:47-49`, `:82`).
+- Hub `internal/offsitekeys/service.go:288` `MaxRemove(countBefore)` = **half of what is there, at least 5**. An operator
+  one-shot grant may raise it for one window (`store/offsite_keys.go:179` `GrantOffsiteWindowOnceMax`, R-833: „after a
+  long gap the honest backlog exceeds half the snapshots and the default cap refuses every window").
+
+## demo-hp's store (read only, the box's own transport; `restic snapshots` + `restic forget --dry-run`, `--no-lock`)
+
+- 359 snapshots, 18 groups (one per app). restic's own dry-run plan: **keep 150, remove 209**.
+- **Every removal is 7–30 days old; none is younger than 7 days.** Every group keeps snapshots: the nine long-lived apps
+  keep 11 each (remove 16), the five media apps keep 9 (remove 11–13), rallly/grimmory keep 2 (remove 4), nextcloud and
+  vaultwarden keep their 1 (remove 0). No group loses its last copy.
+- The bulk: **2026-10-16 holds 152 snapshots** (that day's test runs on demo-hp); every other day ~14 (one per app). The
+  keep-daily rule keeps one per day, so the extra ~138 of 10-16 go, plus the normal ageing-out.
+
+**Verdict: the plan is honest** — superseded copies by the keep rule, nothing it should keep.
+
+## Can it get back under the cap by itself? No.
+
+Hub window history (`offsite_windows`, hub DB with its WAL): demo-hp 10-12 pruned 190→100; 10-19 pruned 324→261; **10-26
+refused** (359, plan 209 > cap 179). Each refused week adds ~98 snapshots (14 a day) and nothing is removed, so the cap
+grows ~49 a week while the plan grows ~84 (the normal ageing plus the stuck backlog): the gap widens every week, and the
+box mails the operator an error each Sunday. demo-felhom (the 2026-10-05 refusal was pre-R-867) and Tester 1 pruned
+normally today (63→48, 78→57) — only demo-hp has this shape, caused by one day of 152 test snapshots.

documentation/audits/r1295-pbsdr-selfcheck-2026-10-26/fresh-install/install/install-pressed.txt

@@ -0,0 +1 @@
+Install pressed 11:43:16Z

documentation/audits/r1295-pbsdr-selfcheck-2026-10-26/fresh-install/proof.txt

@@ -0,0 +1,19 @@
+# R-1295 live proof on hub 0.172.0-rc.1 (2026-10-26): a fresh install as Tester4 (VM 9373 on demo-hp, public ISO 1.30.0).
+Install pressed 11:43:16Z
+bind 11:51:01Z (public /bind page, 200 Sikeres)
+## hub log (channel A)
+2026/10/26 12:51:01 [INFO] self-bind SUCCESS: appliance 53 bound to customer Tester4 by customer self-service (token 39e83db7…)
+2026/10/26 12:51:49 [INFO] host enrolled: Tester4-b5ec39 (customer Tester4)
+2026/10/26 12:52:19 [INFO] host-report from Tester4-b5ec39 (0 guests, 2 storage targets, 0 backups, 0 restore-tests, 0 pbs-snapshots, 12221 bytes)
+2026/10/26 12:52:19 [INFO] tenantsync: provision ok for Tester4 (ns=Tester4, token_id=felhom@pbs!Tester4; secret withheld from logs)
+2026/10/26 12:52:19 [INFO] pbsdr provisioned for Tester4 (host Tester4-b5ec39, ns Tester4, token_id felhom@pbs!Tester4, gen 2; secret stored consume-once, withheld from logs)
+2026/10/26 12:52:19 [INFO] pbsdr auto-provisioned for Tester4 on WG registration (hands-free cascade)
+2026/10/26 12:58:53 [INFO] Event from Tester4: backup_tier_skipped (warning) — Whole-guest backup tier felhom-pbs skipped: its storage does not exist on the host (never provisioned or removed). No app was stopped for it.
+2026/10/26 12:58:53 [INFO] Operator email suppressed for Tester4/backup_tier_skipped — the box enrolled less than 1h0m0s ago
+2026/10/26 13:07:24 [INFO] host-report from Tester4-b5ec39 (1 guests, 2 storage targets, 1 backups, 0 restore-tests, 0 pbs-snapshots, 18286 bytes)
+2026/10/26 13:07:25 [INFO] pbs token secret consumed by host Tester4-b5ec39 (single-use; value withheld from logs)
+2026/10/26 13:22:24 [INFO] host-report from Tester4-b5ec39 (1 guests, 3 storage targets, 1 backups, 0 restore-tests, 1 pbs-snapshots, 19649 bytes)
+## ep0, read only (channel B)
+token felhom@pbs!Tester4 present; ACL /datastore/felhom-offsite/Tester4: felhom@pbs!Tester4 + felhom@pbs DatastoreBackup; 0 proxy 403s for Tester4 since 11:50Z
+## the box's own report (hub DB with WAL)
+consumed_at=2026-10-26 12:07:25 report=2026-10-26 12:22:24 storages=['felhom-pbs', 'local', 'local-lvm'] pbs_snapshots=1

documentation/audits/r1295-pbsdr-selfcheck-2026-10-26/teardown.txt

@@ -0,0 +1,12 @@
+name: r1295-box
+scsi0: nvme-scratch:9373/vm-9373-disk-0.raw,size=64G
+scsi1: nvme-scratch:9373/vm-9373-disk-1.raw,size=48G
+scsihw: virtio-scsi-single
+hostname: pbs-r1295-loop
+rootfs: nvme-scratch:9374/vm-9374-disk-0.raw,size=8G
+purging VM 9373 from related configurations..
+purging CT 9374 from related configurations..
+0
+0
+0
+Mem:              29          13           9           0           6          15