fix(backup): 手动备份按服冷却、每服保留上限与独立保留期，容量驱逐不再删除回收世界的唯一副本

deploy/bootstrap.sh

@@ -2314,13 +2314,14 @@ persisted_auth_source_blocks() {
 }
 
 # persisted_archive_block echoes the operator-owned [archive] keys an earlier run
-# left behind — the retention window, the pre-reap warn offsets, the local cap —
-# so a re-run does not silently revert them to the built-ins the reaper carries
-# (felis reaper reads these from the config Secret at run time; defaults: 90d
-# retention, 3d/1d warnings, no cap). store and local_path are NOT carried: this
-# script owns them (FELIS_ARCHIVE_LOCAL_PATH must equal the mount). Same
-# first-readable-file rule as persisted_smtp_block; warn_before must be a
-# single-line TOML array (the shape every writer here emits).
+# left behind — the retention window, the pre-reap warn offsets, the local cap,
+# the on-demand backup retention/count/cooldown — so a re-run does not silently
+# revert them to the built-ins (felis reaper, felis backup and felis api read
+# these from the config Secret; defaults: 90d retention, 3d/1d warnings, no cap,
+# manual backups kept 30d, 5 per server, one per 10m). store and local_path are
+# NOT carried: this script owns them (FELIS_ARCHIVE_LOCAL_PATH must equal the
+# mount). Same first-readable-file rule as persisted_smtp_block; warn_before must
+# be a single-line TOML array (the shape every writer here emits).
 persisted_archive_block() {
   local f out
   for f in "${STATE_DIR}/felis.host.toml" "${STATE_DIR}/felis.pod.toml"; do
@@ -2328,7 +2329,7 @@ persisted_archive_block() {
     out="$(awk '
       /^[[:space:]]*\[/ { sect = $0; next }
       sect ~ /^[[:space:]]*\[archive\][[:space:]]*$/ &&
-        /^[[:space:]]*(retention|warn_before|max_local_bytes)[[:space:]]*=/ { print }
+        /^[[:space:]]*(retention|warn_before|max_local_bytes|manual_retention|manual_keep|manual_cooldown)[[:space:]]*=/ { print }
     ' "$f")"
     [ -n "$out" ] || continue
     printf '%s\n' "$out"