[sinkog]

Documentation only: the proposal for the decisions S3 (the store and its access), S5 (retention) and S9 (custody) for the independent copy of the T3 time evidence (docs/en/T3-EVIDENCE-STORAGE-DECISION-PROPOSAL.md). Nothing is created, uploaded or paid for; no account exists; no provider is selected until the owner says so. The archive is untouched (no repacking, no new hash, no change of verify.sh; SHA-256 e1795fcf...cddab5, 721 205 bytes). State: NOT BACKED UP. Review does not authorize merge.

• Proposal. Online: Backblaze B2, Object Lock in compliance mode, retention 3 000 days (the provider's maximum, about 8.2 years) plus a legal hold, extended once before it runs out to reach ten years; three separate identities (uploader, reader, administrator), the master credential locked away, account two-factor verification, recovery codes kept offline in two places. Fallback if B2's checks fail: Amazon S3. Second class: the archive on write-once or offline media in another physical place. Custody (S9): the approved hash, the custody log and the restore commands in four places, none of them only GitHub (the repository, separate locked objects in the store, the offline medium, the owner's own records).
• Comparison. B2, S3, Scaleway and Wasabi against the required properties (independent of GitHub; versioning; real WORM; separate read and write permissions), with every fact tagged by its source. Facts read in full from the provider's own pages: B2 Object Lock and application keys, S3 Object Lock. Facts that are search excerpts only (the pages refused access) or not obtained are marked as such and must be verified before they could carry an approval. Wasabi is out for 721 KB (a minimum charge tied to 1 TB, about $96 a year).
• Access model: the identities, what each may and may not do, why compliance mode removes the need to trust identities about deletion, and the order upload, lock, prove with a throw-away trial of delete and shorten before the archive is trusted to the setup.
• Retention, cost and risk. Ten years in two layers, with the owner's recorded commitment to extend. The storage price is zero or cents; the costs that matter are a payment method that stays valid, about an hour a year of checking, the one extension, the two-factor device and recovery codes, and the person. The account is the weakest point (the only way to remove a compliance-locked object early is to delete or close the account): a lapsed payment can end a copy, which is why a second copy of a different class is part of the proposal.
• Six checks before approval (V1 to V6): B2 versioning with Object Lock; B2 two-factor for cloud storage accounts; the B2 capability to extend retention without delete rights; the S3 maximum retention and prices; Scaleway's pages if it is to be considered; the provider's terms on account closure and payment lapse.
• Decisions asked: S3, S5, S9, and S10 (who is the account holder, the administrator and the successor, which payment method and role mailbox); nothing is created before.

Not claimed: that any provider is approved or any account exists; that the facts marked as excerpts or not obtained are true; that the archive survives anything until the steps of section 7 have run and a restore drill from the stored object has passed.

Review round (2026-11-05): the archive is protected from the first moment. The earlier order (upload, lock, prove) left a window with the archive on the remote store and not under compliance protection, because enabling Object Lock on a B2 bucket does not by itself lock what is uploaded (the default retention of the bucket must be configured, it is set at the bucket's creation and applies only to files uploaded afterward). Section 3 and section 7 now give the order: (1) the Object Lock bucket with its default compliance retention set at creation, nothing uploaded; (2) a throw-away trial object into that already protected bucket, proving that the bucket default gave it its own retention state, and that delete and shortening are refused and an overwrite keeps the locked version readable (the trial object is locked for the same period, by design, a few bytes; a separate one-day trial bucket is optional for watching an expiry); (3) the real archive into the protected bucket, with the uploader identity only (the uploader needs no retention capability; the administrator sets the bucket default with writeBucketRetentions); (4) read back the object's own retention state and retain-until date, then the legal hold as a supplementary protection; (5) read back by version id, SHA-256, offline restore from the stored object, custody log. The owner's positions are recorded: S3 B2 conditional go after V1 to V3 and V6; S5 ten years go with a mandatory verified extension; S9 four places go; S10 hold (nobody named). The conditional go for B2 is not a permission to create an account, to pay or to upload. New HEAD, so the gate check is needed again.