create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/deploy/media-lifecycle.md

@@ -0,0 +1,129 @@
+# Media upload and lifecycle operations
+
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+
+Freeholder treats an uploaded filename and browser MIME as claims. The server
+accepts an original only after matching its filename extension, declared type,
+byte signature and per-kind size limit. SVG and HTML are not accepted as media.
+Images are additionally decoded before they become ready. The original gets a
+SHA-256 digest; only safe, owner-visible metadata is retained, never raw EXIF
+or GPS fields.
+
+## Limits and paths
+
+| Kind | Accepted formats | Maximum |
+|---|---|---:|
+| Image | JPEG, PNG, GIF, WebP, AVIF | 25 MB |
+| Document | PDF, text, Markdown, CSV, JSON, DOCX, XLSX, PPTX | 100 MB |
+| Audio | MP3, WAV, Ogg, FLAC, M4A | 500 MB |
+| Video | MP4/M4V, MOV, WebM | 5 GB |
+
+The application proxy is capped at 25 MB. A private S3-compatible adapter
+exposes multipart upload instead: the browser sends 8 MB parts to short-lived
+presigned URLs, records each ETag, and can resume the durable upload session.
+Local and Replit storage state plainly that only the proxy path is available.
+A public S3 bucket never receives direct multipart uploads because the staged,
+unvalidated object would be reachable before completion.
+
+## Required private-bucket CORS
+
+Allow the deployed Freeholder origin, not `*`. The equivalent S3 JSON is:
+
+```json
+[
+  {
+    "AllowedOrigins": ["https://your-freeholder.example"],
+    "AllowedMethods": ["PUT"],
+    "AllowedHeaders": ["content-type"],
+    "ExposeHeaders": ["ETag"],
+    "MaxAgeSeconds": 3600
+  }
+]
+```
+
+Keep the bucket private and leave `S3_PUBLIC` unset. Freeholder signs ready
+image/audio/video URLs and always streams documents through a controlled,
+`nosniff`, attachment-only response. Configure the provider's own rule to
+abort incomplete multipart uploads after two days as defence in depth;
+Freeholder also aborts its expired sessions hourly.
+
+## Client-gallery asset privacy
+
+Adding an asset to a client gallery marks it private across public media and
+project views, including an asset already reused in a published case study.
+Publication consent remains required; it does not override private delivery.
+Migration `0023_gallery_private_delivery.sql` applies this privacy ceiling to
+assets already attached to client galleries. Removing an asset from a gallery
+does not automatically make it public again. Use a separate public asset for
+public presentation with the required consent.
+
+Controlled gallery routes continue to check the session, item permissions,
+watermark/download policy and consent. Consent withdrawal blocks those routes
+as well. Keep object storage private; application checks cannot revoke
+previously delivered copies or existing signed URLs.
+
+## Malware scanner
+
+Structural validation always runs. With no antivirus engine, assets record
+`scan_status = not_configured` and the media console says so; the product never
+calls that state clean. To connect an existing self-hosted ClamAV daemon:
+
+```dotenv
+MALWARE_SCANNER=clamav
+CLAMAV_HOST=clamav.internal
+CLAMAV_PORT=3310
+```
+
+No file is written to instance disk. The original streams to clamd using its
+INSTREAM protocol. A detected signature or scanner error quarantines the
+asset, public resolvers return no URL, and the controlled storage route returns
+404. **Scan again** re-runs the configured engine. `pnpm doctor` sends ClamAV's
+harmless standard test signature and fails unless the engine detects it.
+
+## Durable object inventory and recovery
+
+`media_uploads` is the resumable session state. `media_objects` is the exact
+inventory of originals and renditions. Before any application-side write,
+Freeholder commits a pending ledger row; attaching it happens in the Asset
+transaction. A failed transaction therefore leaves visible cleanup work, not
+an unknowable object in a bucket.
+
+- `core.sweepMediaOrphans` runs hourly. It aborts expired multipart sessions,
+  removes staged bytes, and deletes pending objects older than 24 hours.
+- Moving an asset to trash revokes its resolvers immediately but keeps every
+  byte for 30 days.
+- Restore returns a non-infected asset to ready state in one action.
+- Permanent purge is owner-only, requires fresh step-up authentication and the
+  exact filename, and removes every inventoried original/rendition before its
+  database row.
+- `core.purgeExpiredMedia` processes up to 100 expired trash rows each day.
+
+If a purge is interrupted, the Asset row remains inspectable and the next run
+retries idempotent object deletes. Before enabling production traffic, verify
+the database/media backup and restore drill required by MASTER.md C1.23; never
+use permanent purge as a substitute for that backup policy.
+
+## Verification
+
+After changing storage, CORS or ClamAV:
+
+1. Run `pnpm doctor` and require storage round-trip success. If ClamAV is
+   selected, require its test-signature check to pass.
+2. Upload one file of each enabled kind. For an object larger than 25 MB,
+   interrupt and retry the upload; the progress should resume from listed S3
+   parts.
+3. Confirm the asset records its canonical MIME, SHA-256, provenance and scan
+   truth. Images must have responsive renditions and a focal point.
+4. Move an asset to trash and verify both its public resolver and a previously
+   known controlled URL return nothing. Restore it and verify delivery returns.
+5. On a disposable test asset only, complete step-up, type its exact filename,
+   purge it, and verify its inventory and objects are gone.
+
+Migration `0029_closed_rockslide.sql` adds accurate bigint `byte_size`
+accounting without changing the previous release's integer `bytes` column,
+then adds lifecycle fields and backfills the object inventory for every
+existing original and variant. A compatibility trigger mirrors writes made by
+the previous release and inventories originals it creates, so an image-swap
+rollback remains writable. Do not reverse the migration until all newer
+application processes are stopped and a verified backup exists.

package/dist/template/deploy/migration-runbook.md

@@ -0,0 +1,117 @@
+# Tier-1 migration runbook
+
+This is the shared procedure for all 30 directed moves among Replit,
+DigitalOcean App Platform, a DigitalOcean Droplet, Railway, Render and Docker
+self-hosting. The database and media formats are provider-neutral; the source
+and target recipe only change how credentials and commands are obtained.
+
+## What must survive
+
+The acceptance invariants are **ids**, **money**, **timestamps**, **media**,
+**locales** and **public-urls**. The CI ownership drill restores a custom-format
+PostgreSQL archive for every directed pair, fingerprints every application
+table, and generates the logical ownership export plus media inventory from
+each restore. The operator verifies the object bytes and public URL after the
+platform move.
+
+## 1. Prepare and rehearse
+
+1. Upgrade the source to a release supported by the target recipe.
+2. Run Doctor and resolve every failure.
+3. Protect `CREDENTIAL_KEY`, `SESSION_SECRET` and provider credentials in a
+   secret manager. They are intentionally absent from the ownership export.
+4. Create a disposable restore database and run `pnpm ownership:drill` against
+   it before scheduling downtime.
+5. Provision the target with its `recipe.yaml` `install` operation. Do not
+   point public DNS at it yet.
+
+## 2. Quiesce and export the source
+
+Put the source behind a maintenance response or otherwise stop writes. Record
+the UTC start time. Keep the old instance and bucket intact until final signoff.
+
+```bash
+pg_dump --format=custom --no-owner --no-privileges \
+  --file freeholder.dump "$SOURCE_DATABASE_URL"
+EXPORT_DATABASE_URL="$SOURCE_DATABASE_URL" pnpm ownership:export -- \
+  --output ownership-export
+```
+
+Verify `ownership-export/manifest.json` and `checksums.sha256`. Its
+`media-manifest.json` is the authoritative key list. Copy each listed object
+from the source store to the target store; use the source and target provider's
+S3/rclone tooling or `scripts/media-transfer.mjs`. Never use a public bucket as
+an intermediate.
+
+`pnpm media:transfer -- --manifest ownership-export/media-manifest.json`
+accepts `SOURCE_STORAGE` and `TARGET_STORAGE` as `s3` or `replit`. For an S3
+side, set the correspondingly prefixed `S3_ENDPOINT`, `S3_REGION`, `S3_BUCKET`,
+`S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY` and optional
+`S3_ADDRESSING_STYLE=virtual`. For a Replit side, set the prefixed
+`REPLIT_BUCKET_ID`. For example, an S3-to-Replit move uses
+`SOURCE_STORAGE=s3`, `SOURCE_S3_*`, `TARGET_STORAGE=replit` and
+`TARGET_REPLIT_BUCKET_ID`. The command refuses an incomplete inventory and
+reads back every target object to compare size and SHA-256 before succeeding.
+
+## 3. Restore the target
+
+Restore into an empty target database. Migrations may run when the target app
+first boots, but they are not a substitute for restoring the owned data.
+
+```bash
+pg_restore --no-owner --no-privileges \
+  --dbname "$TARGET_DATABASE_URL" freeholder.dump
+```
+
+Set the target's `APP_URL` to the final public origin. Keep the same
+`CREDENTIAL_KEY` so encrypted connected-account credentials remain readable.
+Use a new `SESSION_SECRET` only if signing every user out is intentional.
+
+## 4. Verify before DNS
+
+Run the target recipe's `verify` operation against its temporary platform URL.
+Then compare the source ownership export with a target export:
+
+```bash
+EXPORT_DATABASE_URL="$TARGET_DATABASE_URL" pnpm ownership:export -- \
+  --output target-ownership-export
+```
+
+The following must match:
+
+- every table row count and SHA-256 fingerprint (ids, money and timestamps);
+- the locale set and every stored public path/slug (locales and public-urls);
+- media asset IDs, keys, sizes and checksums, with no missing or unreferenced
+  keys in the media inventory (media);
+- a browser request for `/`, `/setup` or `/admin` as appropriate, and an actual
+  upload/read/delete cycle through the target object store.
+
+Do not continue if any comparison differs. Resume the source, investigate and
+repeat the final export.
+
+## 5. Cut over and roll back
+
+Lower DNS TTL in advance. Change DNS only after verification, keep the source
+read-only, and monitor health, authentication, writes, jobs and media. Expected
+application downtime is the final dump/restore window; DNS caches can extend
+visible cutover time.
+
+Rollback means restoring DNS to the still-read-only source. If the target has
+accepted writes, stop both sides and reconcile those writes before rollback;
+never let two writable instances diverge. Retain the old database and bucket
+for the documented recovery window, then revoke old credentials and remove
+them according to the source provider's deletion procedure.
+
+## Pair matrix
+
+Each source row is tested against every other target column by
+`pnpm ownership:drill -- --all-pairs`:
+
+| Source | Valid targets |
+| --- | --- |
+| Replit | DigitalOcean App, DigitalOcean Droplet, Railway, Render, Docker |
+| DigitalOcean App | Replit, DigitalOcean Droplet, Railway, Render, Docker |
+| DigitalOcean Droplet | Replit, DigitalOcean App, Railway, Render, Docker |
+| Railway | Replit, DigitalOcean App, DigitalOcean Droplet, Render, Docker |
+| Render | Replit, DigitalOcean App, DigitalOcean Droplet, Railway, Docker |
+| Docker | Replit, DigitalOcean App, DigitalOcean Droplet, Railway, Render |

package/dist/template/deploy/n1-schema.md

@@ -0,0 +1,34 @@
+# N-1 schema and the upgrade gate
+
+Rollback is an image swap only while release N's schema is still readable by
+release N-1. Expand, then contract.
+
+Two gates keep that true:
+
+1. **Schema-compatibility.** `scripts/schema-compat-gate.mjs` fails an
+   unlabelled `DROP TABLE` / `DROP COLUMN` / rename / retype / required column.
+   An acknowledged break must also set `schemaRisk: "breaking"` in
+   `src/core/update/this-release.ts`, or the updater would treat a contract
+   break as a safe image swap.
+2. **Upgrade gate.** `scripts/upgrade-gate.sh` boots the previous published
+   image, writes a contact, migrates forward with this build, checks the
+   contact and the home page, then boots the previous image against the new
+   schema with `FREEHOLDER_SKIP_MIGRATE=1`. A failed prior-image pull blocks
+   the gate: missing images, registry denial and network failure cannot be
+   distinguished as a successful first-release exception (C11.15).
+
+This is not unattended apply (C10.06) and not target-specific image swap
+(C10.10).
+
+## C10.19 — one-time pre-1.0 baseline
+
+Collapsing `0000`–`0167` into `0000_reviewed-baseline.sql` is an acknowledged
+schema break (`schemaRisk: "breaking"`). A database whose journal still names
+the old chain cannot apply the baseline, and rolling back to a pre-collapse
+image is not an image swap: the previous migrator does not recognise the new
+journal. Fresh installs apply the baseline from empty. This is the only window
+the chain is still ours to collapse; after 1.0 it is somebody else's installed
+history.
+
+Sibling `0168_*` first-party plugin migrations (C3.13) are not in this
+baseline. Fold them in when those PRs land, or rebase this collapse after them.

package/dist/template/deploy/notification-fanout.md

@@ -0,0 +1,92 @@
+# Notification fanout and inbox operations
+
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+
+Freeholder turns selected committed events into one durable notification per
+logical recipient. The personal inbox is the human-facing fact;
+`notification_deliveries` separately records what happened on in-app, email,
+SMS and push channels. Reading or archiving an item never erases delivery
+evidence.
+
+## Delivery contract
+
+Every caller supplies an idempotency key. `notification_receipts` stores every
+accepted key, including later events coalesced into an existing live condition.
+Replaying the same outbox event therefore does not increment the occurrence
+count or create another delivery. A distinct event with the same recipient and
+dedupe key updates the live item, increments its count and reopens it as unread.
+
+Immediate external deliveries are claimed by `core.deliverNotifications` and
+retried at most eight times with bounded errors and exponential backoff. A
+ten-minute processing lease recovers a worker that disappears. Provider calls
+carry the stable notification delivery ID into the mail/carrier adapter.
+In-app deliveries are complete when their row commits.
+
+Email uses the account-mail route documented in `deploy/mail-delivery.md`.
+The console adapter is deliberately recorded as `skipped`, not delivered. Run
+`pnpm doctor` and resolve `mail.delivers` before relying on immediate messages
+or digests.
+
+## Preferences and digests
+
+Open **Admin → Notifications** (`/admin/notifications`). A signed-in person can
+change only their own inbox and preferences; no role can inspect another
+person's queue. An exact topic preference overrides the defaults:
+
+- in-app and email default to immediate;
+- SMS and push default to off;
+- email alone may use daily or weekly digest mode;
+- disabling in-app removes future items from the queue but does not delete the
+  underlying notification or email evidence.
+
+Digest time is interpreted in the saved IANA timezone, including DST changes.
+Due rows for one recipient are claimed together and linked to a normalized
+`notification_digests` batch before account mail is called. The message is
+plain text, bounded, and contains internal action links resolved against
+`APP_URL`. Contact-addressed notifications also snapshot the enabled Contact
+locale; digest groups and catalog boilerplate use that snapshot. See
+`deploy/customer-locales.md` for selection and fallback rules.
+
+## Critical escalation
+
+A critical item receives one escalation pass only if it is still unread and
+unarchived after the personal delay (default 60 minutes). The pass reuses each
+enabled external channel and has a distinct delivery kind. Reading or
+archiving the item before the deadline prevents escalation; a delivered or
+skipped escalation is never looped.
+
+## SMS and push boundary
+
+C1.15 installs the carrier-neutral contract and explicit unavailable adapters.
+It does not send to Twilio or a push network. Production SMS, consent/keyword/
+quiet-hour controls arrive at C7.10–C7.13; push registration and device
+preferences arrive at C10.14. If `adapters.sms` selects Twilio before that
+checkpoint, doctor reports the carrier as unavailable and the delivery ledger
+records a safe skip. Never reinterpret that as delivered.
+
+## Privacy, retention and recovery
+
+Notifications addressed to a Contact participate in contact merge/undo and in
+privacy export/erasure. Preference or settings collisions keep the survivor's
+choice and make merge undo explicitly unavailable rather than guessing.
+Archived notifications are pruned after one year; deleting a recipient
+cascades their notification, receipt and delivery rows.
+
+For a delivery incident:
+
+1. Run `pnpm doctor`; confirm account mail and the background worker.
+2. Inspect the notification and channel row, including `kind`, `status`,
+   attempts, provider and bounded error.
+3. Correct configuration before retrying; do not edit provider references or
+   receipts by hand.
+4. For outbox replay, use **Background work → Event delivery**. The receipt key
+   prevents a second notification even if webhook and notification fanout
+   completed on different attempts.
+
+Migrations `0032_fancy_namora.sql`, `0033_thin_lady_bullseye.sql`, and the
+locale snapshot additions in `0034_furry_ozymandias.sql` are additive. The
+previous release ignores these tables/columns and remains read/write compatible
+after forward migration, so rollback is an image swap. Do not drop notification
+tables merely to disable a channel; set its preference or adapter to off/none
+so delivery history remains truthful.

package/dist/template/deploy/ownership-recovery.md

@@ -0,0 +1,193 @@
+# Ownership, recovery and erasure drills
+
+Freeholder has two different ownership artifacts, because pretending one file
+can be both a recoverable system image and a safe data-portability export makes
+both less trustworthy:
+
+| Artifact | Contains | Deliberately excludes |
+|---|---|---|
+| PostgreSQL custom-format dump | All database schemas, queued work and encrypted connected-account credentials | Media bytes, configuration files and environment secrets |
+| Logical ownership export | Every application-owned table, with authentication columns redacted; declarative config; recovery metadata; media manifest; checksums | Password/session/token hashes, OAuth credentials, signing secrets, second-factor material, raw environment values and database URLs |
+
+Media bytes remain in the configured object store. `media-manifest.json` is the
+bridge: it lists the database's Assets and storage objects, their keys, sizes,
+MIME types, checksums where known, lifecycle state, and any database inventory
+gap. `pnpm media:transfer` reads that artifact, copies across S3-compatible or
+Replit stores, then reads every target object back to compare size and SHA-256.
+See `migration-runbook.md` for the prefixed source/target credentials and
+cutover sequence. A complete recovery needs the database dump, separately
+protected configuration secrets and the object store.
+
+## Create a secret-safe logical export
+
+Run from a trusted machine with enough protected disk space:
+
+```bash
+pnpm ownership:export -- --output /protected/freeholder-export-2026-08-13
+```
+
+`EXPORT_DATABASE_URL` overrides `DATABASE_URL`; `--database-url` is also
+accepted but can remain in shell history, so the environment form is safer.
+The destination must be empty. The command creates files with owner-only modes
+where the operating system supports them and never prints row data or a
+database URL.
+
+Before releasing an export, inspect:
+
+1. `manifest.json`: every non-system base table appears exactly once, with row
+   counts and SHA-256 file checksums.
+2. `recovery.json`: `secretValuesIncluded` is false. A configured 32-byte
+   `CREDENTIAL_KEY` has a fingerprint, never its value.
+3. `media-manifest.json`: investigate `missingInventoryKeys` and
+   `unreferencedInventoryKeys`. The former means database metadata references
+   an object absent from the inventory ledger; the latter is often an
+   interrupted upload awaiting the orphan sweep, but must still be explained.
+4. A search for a known test-only token finds nothing. The export code replaces
+   authentication-bearing columns explicitly instead of using a loose name
+   substring that would erase legitimate fields such as `input_tokens`.
+
+This is a portability and inspection format, not an authentication-state
+restore. C3.18 adds the final single-archive/import UX and richer human
+projections without weakening this boundary.
+
+## Database backup and scratch restore
+
+Use PostgreSQL client tools at least as new as the server:
+
+```bash
+pg_dump --format=custom --no-owner --no-privileges \
+  --file freeholder-2026-08-13.dump "$DATABASE_URL"
+sha256sum freeholder-2026-08-13.dump > freeholder-2026-08-13.dump.sha256
+```
+
+Do not call an archive a backup until a restore has succeeded. Restore into a
+new scratch database, never over the running instance:
+
+```bash
+createdb freeholder_restore_drill
+pg_restore --no-owner --no-privileges \
+  --dbname postgres:///freeholder_restore_drill freeholder-2026-08-13.dump
+EXPORT_DATABASE_URL=postgres:///freeholder_restore_drill \
+  pnpm ownership:export -- --output /protected/restore-inspection
+```
+
+Compare the export manifest, run `doctor` against an application pointed at the
+scratch database, sample business/contact/media counts, and verify several
+object-store keys and checksums. Drop the scratch database only after recording
+the result.
+
+For automated rehearsal, set `TEST_DATABASE_URL` to a disposable database whose
+name contains `test` or `drill`, then run:
+
+```bash
+pnpm ownership:drill
+```
+
+The guard rejects ordinary database names. The drill creates a random restore
+database on the same server, runs real `pg_dump` and `pg_restore`, compares the
+row count and canonical digest of every non-system table, generates the
+secret-safe export from the restored copy, and removes its temporary database
+and files. CI runs it on every change.
+
+The DigitalOcean Droplet recipe's nightly script uploads the database archive
+to a versioned bucket. Its `verify.md` remains the infrastructure rehearsal;
+this repository gate proves the archive itself and the logical inventory.
+
+## Configuration and credential keys
+
+`freeholder.config.ts` is declarative and contains no secrets, so the logical
+export copies it. `recovery.json` also copies an explicit allowlist of
+non-secret environment configuration and strips URL credentials, queries and
+fragments. `.env` is never copied; every known secret variable contributes
+only its name and configured/unconfigured state. Keep an encrypted environment
+backup in a secrets manager separate from the database archive and record who
+can recover it.
+
+`CREDENTIAL_KEY` is uniquely important. The database contains only AES-256-GCM
+ciphertext for connected accounts. Losing the key means reconnecting every
+account; possessing only the key without the database is not useful. Match the
+SHA-256 fingerprint in `recovery.json` before a restore, but retrieve the key
+itself only from the separate secrets backup.
+
+Rotate without downtime:
+
+1. Preserve the current key in the secrets backup and record its fingerprint.
+2. Generate a new independent 32-byte key.
+3. Set the new value as `CREDENTIAL_KEY` and the old value as
+   `CREDENTIAL_KEY_PREVIOUS`; deploy both together.
+4. Call `connections.rotateCredentials` as a signed-in connection manager with
+   required two-factor step-up. Re-run until `failed` is zero; the operation is
+   idempotent and resumes after interruption.
+5. Run doctor and exercise each connected provider.
+6. Remove `CREDENTIAL_KEY_PREVIOUS`, deploy, run doctor again, update the
+   secrets backup, and retain the old key only under the backup-retention
+   policy needed to restore older database archives.
+
+## Who can reach a connected account
+
+Rotating a key changes how a credential is stored. It does not change *who*
+may use it, and those are separate questions with separate answers.
+
+An agent's scopes say what kind of work it may do. They never say whose
+account it may do that work with: on an instance holding the owner's mailbox,
+a shared shop inbox and a staff member's personal calendar, an agent scoped to
+read calendars would otherwise read all three. So reaching a connected account
+is a second, narrower permission (`agent_connection_grants`), granted one
+agent and one account at a time:
+
+- `connections.grantToAgent` — an owner or connection manager, signed in with
+  a fresh second factor, gives one worker `read` or `write` on one account.
+- `connections.revokeFromAgent` — takes it back. Deliberately *not* behind
+  step-up: removing access is the safe direction and should never wait.
+- `connections.grants` lists every grant, including revoked ones. Revocation
+  is a timestamp rather than a deletion, so "did that agent ever have access
+  to my calendar, and when did it stop" has an answer.
+- `connections.mine` is what an agent itself sees: the accounts it was given,
+  never the rest, and never a credential.
+
+Two cascades matter when recovering or auditing an instance:
+
+- A provider withdrawing consent (`connections.flag` with `revoked`) revokes
+  every agent grant on that account in the same transaction. The list of who
+  can reach a mailbox stays true at the moment it matters most.
+- An account that merely `needs_reconnect` keeps its grants — an expired token
+  is not the owner changing their mind — but cannot be used until it is
+  reconnected, and the reconnect notification names how many agents are
+  waiting on it.
+
+After restoring a database into a new environment, review `connections.grants`
+before resuming agent work: the grants come back with the data, and an
+instance restored for testing should usually have them revoked rather than
+left pointing at production mailboxes.
+
+If neither current nor previous key decrypts a row, Freeholder marks the
+connection `needs_reconnect` instead of deleting ciphertext or retrying into a
+provider lockout. A lost key is a reconnect incident, not a reason to weaken
+encryption.
+
+## Retention and erasure proof
+
+Erasure applies to the live system and future backups. It cannot alter an
+already-created immutable backup. Protect backup access, expire archives on a
+documented schedule, and if an old archive is restored, reapply completed
+erasure records before that copy can serve users.
+
+The repository's ordinary test gate proves:
+
+- `contact-privacy-rights.test.ts`: complete registered-scope export/erasure,
+  customer-login revocation, named legal-retention exceptions, suppression
+  evidence, step-up and exact confirmation, artifact expiry and pruning.
+- `registry-completeness.test.ts`: every contact-bearing table registers its
+  export, erasure and merge behavior instead of becoming a shadow store.
+- `media.test.ts`: reversible thirty-day trash, exact owner-only purge,
+  scheduled expiry purge, storage-object deletion and orphan cleanup.
+- analytics, CSP, sessions, outbox, webhook, notification and job suites:
+  bounded retention and scheduled pruning for their operational records.
+- `connections.test.ts`: an old backed-up key decrypts during rotation, every
+  credential is rewritten under the new key, and the previous key can then be
+  removed.
+
+Record restore-drill date, source archive checksum, restored table/row totals,
+media discrepancy counts, key fingerprint match, retention/erasure checks and
+the operator. Never put raw credentials or personal row contents in the drill
+record.