doc: instance leg to S3 shelved; ks2 push is the interim off-site leg

Decided 2026-08-28: instances are protected by replication (sdb now,
nuc after FTTH, ks2 push in between), their data/DBs/configs by
restic-data — a third copy of instance filesystems in S3 was not
worth the moving parts. backup-strategy.md now explains the
replication-vs-backup split and the rebuild path when no replica
survives; restic-backup.md §6 is marked SHELVED (script and empty
repo kept).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ks4/local-backup-cron.md

@@ -12,9 +12,9 @@ backup of any kind was running). Overview of all legs:
 
 - `01:00` — **local leg**: `incus copy --refresh` of all instances
   into project `backup` on the sdb5 `backup` zpool (replaces the old
-  push to ks2; see [incus-copy.md](incus-copy.md)). The S3 instance
-  leg ([restic-backup.md](restic-backup.md) §6) chains onto this same
-  line once seeded — it reads the replicas this job just refreshed.
+  push to ks2; see [incus-copy.md](incus-copy.md)). An S3 leg for the
+  instance filesystems was designed and shelved
+  ([restic-backup.md](restic-backup.md) §6).
 - The rsync stopgap to ks2 (`incus-backup.sh`, 04:00) and the plakar
   data leg (04:30) are both **retired**; S3 backups are restic's job
   at 05:00.

ks4/restic-backup.md

@@ -5,8 +5,10 @@ backup tool (plakar crons off, its kloset kept for
 [#2338](https://github.com/PlakarKorp/plakar/issues/2338); see §8).
 Architecture: **two tools** — `incus copy` for replication (local sdb,
 nuc after FTTH), **restic** for everything S3. Data leg (`restic-data`)
-runs nightly at 05:00; the instance leg (`restic-incus`, §6) is written
-and awaits its first seed.
+runs nightly at 05:00. The instance leg (`restic-incus`, §6) is
+**shelved** (2026-08-28): instances are covered by replication, so
+duplicating their filesystems into S3 buys little. The script and the
+(empty) repo stay in place should that change.
 
 Why: plakar's incremental cost scales with tree size, not churn
 (~800 MiB parent metadata re-read from S3 + hours of CPU per night on
@@ -24,7 +26,7 @@ patches to maintain (see §6).
 | bucket = repo | contents | driver script |
 |---|---|---|
 | `restic-data` | SQL dumps + **all** fs sources (8 small + nextcloud + seafile) | `restic-backup.sh` |
-| `restic-incus` | the `backup`-project replicas, per-file via mount | `restic-incus-backup.sh` |
+| `restic-incus` | *(shelved — empty repo, see §6)* the `backup`-project replicas, per-file via mount | `restic-incus-backup.sh` |
 
 Mirrors the plakar-era split (data leg / incus leg). Accepted
 trade-off: `restic-data` carries the giants' blobs (~3–5 M once
@@ -183,8 +185,8 @@ Same shape as the plakar drivers (flock, env, loud logging). Phases:
    `--group-by host` because seed-era snapshots have different path
    sets than nightly ones and must age in one group).
 
-The instances leg is `restic-incus-backup.sh` (§6), chained after the
-01:00 incus-copy once validated.
+The instances leg (`restic-incus-backup.sh`, §6) is shelved — nothing
+chains onto the 01:00 line today.
 
 ```cron
 0 5 * * * /root/scripts/restic-backup.sh >> /var/log/restic-backup.log 2>&1
@@ -212,7 +214,15 @@ Then `restic check` (structure, cheap) + `check
 --read-data-subset=1/52` rotating — full data verification of every
 byte once a year, ~25 GiB read per week.
 
-## 6. Instances without a plugin — `incus file mount`
+## 6. Instances without a plugin — `incus file mount` (SHELVED)
+
+> Decided 2026-08-28: **not deployed.** Instances are replicated (sdb,
+> nuc after FTTH, ks2 in the meantime) and everything needed to
+> rebuild one is in `restic-data`, so a third copy of their
+> filesystems was judged not worth the nightly moving parts. The
+> design and the script remain, ready if that changes.
+> If the `restic-incus` bucket is ever deleted, drop it from `REPOS`
+> in `restic-maintenance.sh` too.
 
 Neither restic nor rustic accepts source plugins, and forking the
 backup tool is the wrong place to carry a patch. Instead, incus
@@ -264,9 +274,10 @@ diff -r … && rm -rf /backup/restore-test
   nextcloud tree, churn-independent; restic: seed at 60–115 MiB/s,
   local-cache incrementals). plakar's measurements stay in
   [plakar-s3-data.md](plakar-s3-data.md).
-- **Left to do**: seed `restic-incus` (§6) and chain it onto the 01:00
-  line; restore test on the complete `restic-data`; then the ks2
-  decommission gates ([../ks2/plan.md](../ks2/plan.md)).
+- **Left to do**: restore test on the complete `restic-data`; re-enable
+  the interim ks2 push until FTTH; then the ks2 decommission gates
+  ([../ks2/plan.md](../ks2/plan.md)). The instance leg (§6) is
+  shelved, not pending.
 - **plakar retirement, one exception**: keep plakar installed and
   keep the `plakar-data` kloset until
   [#2338](https://github.com/PlakarKorp/plakar/issues/2338) concludes