ep0-copy-gc: fail-safe guards (partial ep0 list aborts, one deletion per run, HOLD file) — from the commit security review; still not installed

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/ep0-datastore-copy.md

@@ -72,6 +72,10 @@ rebuild an endpoint and pull back, so every host reconnects the usual way.
 
 ### Route 2 — rebuild the endpoint. Not walked.
 
+**First, on DooPlex: `sudo touch /etc/felhom/ep0-copy-gc/HOLD`** (when the removal job is installed) — a rebuilt or
+half-restored ep0 lists fewer namespaces, and the job must not read that as customer deletions. Remove the file when ep0
+lists every customer again.
+
 Provision a new ep0 (06 §5), then on it add DooPlex as a remote and run
 `proxmox-backup-manager pull <dooplex-remote> ep0-copy felhom-offsite`. Every box then reconnects as before.
 
@@ -84,7 +88,9 @@ Ruling: removed **within 30 days**. The job `scripts/ep0-copy-gc/felhom-ep0-copy
 08:00: a top-level namespace in the copy that ep0 no longer lists is remembered with the day it was first seen absent;
 after **7 days** absent it is deleted from the copy (`proxmox-backup-client namespace delete <ns> --delete-groups true`);
 one that reappears is forgotten; `operator` is never deleted. If ep0's list cannot be read, or reads empty, it does
-nothing. Without `--apply` it only prints. Worst case: ≤ 1 day to notice + 7 days grace + 1 day = inside 30 days.
+nothing; if more than 2 namespaces are absent at once (a partial list, e.g. a rebuilt ep0) it does nothing; it
+deletes at most one namespace per run; a HOLD file (`/etc/felhom/ep0-copy-gc/HOLD`) stops it. Without `--apply` it
+only prints. Worst case: ≤ 1 day to notice + 7 days grace + 1 day = inside 30 days.
 
 **Not installed. To install (needs the operator's word — it is a change on DooPlex and it deletes data):**
 1. Two tokens, secrets in root-only files under `/etc/felhom/ep0-copy-gc/` (0600), never printed: