docs: restore drill passed — S3 leg gate closed

18/18 instances replicated, restic seed complete and restore-tested
(tree identical to live; dump loads into a scratch MariaDB, 12/12
tables). Remaining ks2 gates are the nuc leg after FTTH.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-strategy.md

@@ -22,8 +22,11 @@ Sep 30, 2026 — [ks2/plan.md](ks2/plan.md)); until FTTH enables the nuc
 leg it still receives an interim replica push.
 
 **Status 2026-08-28**: local replication and the S3 backup leg are
-live. The **nuc pull leg waits for FTTH** (expected before end of
-September); until then the ks2 push stands in. Backing up whole
+live, and the S3 leg has been **restore-tested** (a file tree came
+back identical to the live one; a database dump loaded into a scratch
+server with all its tables). The **nuc pull leg waits for FTTH**
+(expected before end of September); until then the ks2 push stands
+in. Backing up whole
 instance *images* to S3 was considered and left out — S3 holds the
 data, the databases and the incus configuration, which is what a
 rebuild needs.

ks2/plan.md

@@ -75,8 +75,10 @@ when nuc takes over.
 ## Release gates — ks2 can be dropped only when
 
 - [x] biwiki + spot consciously abandoned (2026-08-22)
-- [ ] local leg cron running ≥ a few days, all instances present
+- [x] local leg cron running since 2026-08-22, **18/18 instances**
+      replicated (verified 2026-08-28)
 - [ ] nuc leg fully seeded **and** one instance test-restored
-- [ ] restic S3 data/DB backups running daily **and** one DB + one
-      file tree test-restored
+- [x] restic S3 backups live (05:00) **and** restore drill passed
+      2026-08-28: tree restored byte-identical to live, dump restored
+      and loaded into a scratch MariaDB (12/12 tables)
 - [ ] ks4 crons pointing at ks2 disabled

ks4/restic-backup.md

@@ -283,8 +283,10 @@ deleted.
   nextcloud tree, churn-independent; restic: seed at 60–115 MiB/s,
   local-cache incrementals). Details in
   [plakar-s3-data.md](plakar-s3-data.md).
-- **Left to do**: restore test on the complete `restic-data`; re-enable
-  the interim ks2 push until FTTH; then the ks2 decommission gates
+- **Done 2026-08-28**: initial sync (1,114,212 files / 1.239 TiB in
+  4h10m, only 2.4 GiB added thanks to dedup + the seafile GC), restore
+  drill passed (§7), interim ks2 push re-enabled.
+- **Left**: the nuc leg after FTTH, then the ks2 decommission
   ([../ks2/plan.md](../ks2/plan.md)). The instance leg (§6) is
   shelved, not pending.
 - **Old tool**: see the legacy note above; the `integration-incus`