fix(backup): 手动备份按服冷却、每服保留上限与独立保留期，容量驱逐不再删除回收世界的唯一副本

deploy/bootstrap.sh

@@ -2314,13 +2314,14 @@ persisted_auth_source_blocks() {
 }
 
 # persisted_archive_block echoes the operator-owned [archive] keys an earlier run
-# left behind — the retention window, the pre-reap warn offsets, the local cap —
-# so a re-run does not silently revert them to the built-ins the reaper carries
-# (felis reaper reads these from the config Secret at run time; defaults: 90d
-# retention, 3d/1d warnings, no cap). store and local_path are NOT carried: this
-# script owns them (FELIS_ARCHIVE_LOCAL_PATH must equal the mount). Same
-# first-readable-file rule as persisted_smtp_block; warn_before must be a
-# single-line TOML array (the shape every writer here emits).
+# left behind — the retention window, the pre-reap warn offsets, the local cap,
+# the on-demand backup retention/count/cooldown — so a re-run does not silently
+# revert them to the built-ins (felis reaper, felis backup and felis api read
+# these from the config Secret; defaults: 90d retention, 3d/1d warnings, no cap,
+# manual backups kept 30d, 5 per server, one per 10m). store and local_path are
+# NOT carried: this script owns them (FELIS_ARCHIVE_LOCAL_PATH must equal the
+# mount). Same first-readable-file rule as persisted_smtp_block; warn_before must
+# be a single-line TOML array (the shape every writer here emits).
 persisted_archive_block() {
   local f out
   for f in "${STATE_DIR}/felis.host.toml" "${STATE_DIR}/felis.pod.toml"; do
@@ -2328,7 +2329,7 @@ persisted_archive_block() {
     out="$(awk '
       /^[[:space:]]*\[/ { sect = $0; next }
       sect ~ /^[[:space:]]*\[archive\][[:space:]]*$/ &&
-        /^[[:space:]]*(retention|warn_before|max_local_bytes)[[:space:]]*=/ { print }
+        /^[[:space:]]*(retention|warn_before|max_local_bytes|manual_retention|manual_keep|manual_cooldown)[[:space:]]*=/ { print }
     ' "$f")"
     [ -n "$out" ] || continue
     printf '%s\n' "$out"

deploy/bootstrap_test.sh

@@ -1046,6 +1046,8 @@ region = "us-east-1"
 store = "tarLocal"
 local_path = "/stale/path"
 retention = "30d"
+manual_keep = 3
+manual_cooldown = "1h"
 
 [offsite]
 endpoint = "https://objects.example"
@@ -1076,6 +1078,8 @@ expect "a re-run carries the [registry.s3] uploads subtable" "[registry.s3]" "$o
 expect "the carried subtable keeps its keys" 'endpoint = "https://s3.example"' "$out"
 expect "url stays installer-owned" 'url = "registry.felis.svc:5000"' "$out"
 expect "a re-run carries the archive retention window" 'retention = "30d"' "$out"
+expect "a re-run carries the on-demand backup count" 'manual_keep = 3' "$out"
+expect "a re-run carries the on-demand backup cooldown" 'manual_cooldown = "1h"' "$out"
 expect "the archive mount stays installer-owned" 'local_path = "/a"' "$out"
 expect "a re-run keeps the off-site bucket, set apart from the next section" '[offsite]
 endpoint = "https://objects.example"