From 1996d8e4730c2897449c4260d23b7b1fd0b37716 Mon Sep 17 00:00:00 2001
From: mkn <matej@nechodom.cz>
Date: Mon, 5 Oct 2026 14:09:32 +0200
Subject: [PATCH 1/2] fix(backup): drop local copies that are already off-site,
 and say why one stays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An operator saw backups marked "off-site ✓" still sitting on the server and
read it as a broken delete. It was not: "Delete the local copy once it is
verified off-site" is off by default, it only ever acted on the backup that
had just finished, and nothing on the Backups tab said either.

- After each backup, with the option on, the site's OLDER local copies that
  are on record off-site are re-verified and dropped too, past a new
  `[backup] keep_local_latest` (keep the N newest locally, default 0). Turning
  the option on now frees existing copies at the site's next archive backup.
- "Off-site & drop" (per row and bulk) re-checks an already-off-site backup
  where it is and drops it without uploading it again; it only falls back to
  a push when the re-check fails. The estate-wide "Copy off-site & delete
  local" now also covers copies that were already off-site (it used to skip
  them, while the Settings hint pointed operators at it), honours the keep
  count, and heartbeats its job.
- The Backups tab says, per row, why a local copy is still there (option off,
  one of the newest N kept, not confirmed off-site, or dropping at the next
  backup), from the owning node's settings; a refused drop stores its reason
  on the row (`local_note`, migration 076). Jobs go red when a copy was kept.
- S3 pushes are recorded on the run (`s3_ok_targets`, migration 076): the S3
  push never wrote any off-site state, so S3-only nodes could never drop an
  older copy, and a keep count disabled dropping there entirely. A failed
  re-push removes the target again (age objects are trusted by existence only
  with a complete push on record).
- Safety: an archive a restore, backup or push is using is never dropped or
  pruned; a restore whose dump vanishes mid-way now fails instead of
  reporting success with the files of one moment and the current database;
  an unreachable target stops the sweep instead of waiting out every timeout
  (curl connect-timeout 15s); an unreadable keep count disables dropping
  rather than meaning "keep 0"; an archive already gone from disk is reported
  missing and its row set straight, not counted as kept forever.
- "off-site ✓" (FTP verified) now requires the database dump to size-check
  too, as the drop step always did. Rollback snapshots are no longer pushed
  to FTP (S3 and the drop already skipped them). The manifest is removed with
  its archive on drop and prune instead of being orphaned.
- An older node that does not know `keep_local_latest` still gets the on/off
  switch when leaving the count out changes nothing there.
- Error text named `[remote_backup]`; the section is `[backup_remote]`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 bin/hyperion-web/src/handlers/hostings.rs     |   32 +-
 bin/hyperion-web/src/handlers/settings.rs     |  159 +-
 .../templates/hostings_detail.html            |   29 +-
 bin/hyperion-web/templates/settings.html      |   44 +-
 crates/hyperion-adapters/src/backup.rs        |    4 +
 crates/hyperion-core/src/service.rs           | 1571 +++++++++++++++--
 crates/hyperion-state/migrations.sha256       |    1 +
 .../migrations/076_backup_local_note.sql      |   26 +
 crates/hyperion-state/src/backups.rs          |  255 ++-
 crates/hyperion-types/src/limits.rs           |   43 +
 crates/hyperion-types/src/stats.rs            |    6 +
 packaging/agent.toml.example                  |   20 +-
 12 files changed, 1989 insertions(+), 201 deletions(-)
 create mode 100644 crates/hyperion-state/migrations/076_backup_local_note.sql

diff --git a/bin/hyperion-web/src/handlers/hostings.rs b/bin/hyperion-web/src/handlers/hostings.rs
index 10bf278b..394aae6f 100644
--- a/bin/hyperion-web/src/handlers/hostings.rs
+++ b/bin/hyperion-web/src/handlers/hostings.rs
@@ -2715,6 +2715,14 @@ async fn fetch_expiry(
     }
 }
 
+/// Does any listed backup keep its local copy only because the owning node
+/// has "Delete the local copy once it is verified off-site" switched off? The
+/// Archives card then says so once, above the table — "off-site ✓" next to a
+/// local path otherwise reads as a delete that silently failed.
+pub(crate) fn backups_kept_by_setting(backups: &[hyperion_types::BackupRunWire]) -> bool {
+    backups.iter().any(|b| b.local_kept == "setting_off")
+}
+
 async fn fetch_backup_list(
     state: &SharedState,
     target: Option<&str>,
@@ -4848,13 +4856,35 @@ pub(crate) async fn run_offsite_drop_job(
                 r.kept_local,
                 if r.kept_local == 1 { "y" } else { "ies" },
             ));
+            if r.already_offsite > 0 {
+                log.push_str(&format!(
+                    "            ({} of those were already off-site: re-checked there and \
+                     dropped without being uploaded again)\n",
+                    r.already_offsite
+                ));
+            }
             // Red when anything the operator selected FAILED — including ids
             // that no longer exist (a concurrent delete or a stale page): those
             // land in `failed` without touching `considered`, so a
             // `considered == 0` success clause would report green when every
             // selected item failed. Mirror the estate-wide sweep's predicate.
+            //
+            // And red when a copy was KEPT: the operator asked for the local
+            // copy to go, and a green job next to a backup that is still on
+            // disk reads as "done" when it is not.
             reporter.step("Finished.", 100, &log).await;
-            reporter.finish(r.failed == 0, None).await;
+            let kept = (r.kept_local > 0).then(|| {
+                format!(
+                    "{} local cop{} kept — not confirmed off-site; the Backups tab says why",
+                    r.kept_local,
+                    if r.kept_local == 1 {
+                        "y was"
+                    } else {
+                        "ies were"
+                    },
+                )
+            });
+            reporter.finish(r.failed == 0 && kept.is_none(), kept).await;
         }
         Ok(RpcResponse::Error(e)) => reporter.finish(false, Some(e.to_string())).await,
         Ok(_) => {
diff --git a/bin/hyperion-web/src/handlers/settings.rs b/bin/hyperion-web/src/handlers/settings.rs
index 10a981d6..835380ef 100644
--- a/bin/hyperion-web/src/handlers/settings.rs
+++ b/bin/hyperion-web/src/handlers/settings.rs
@@ -1833,12 +1833,46 @@ async fn propagate_notifications(
                 Some(node_id.as_str()),
                 Request::AgentConfigUpdate {
                     section: sect.to_string(),
-                    fields: f.into(),
+                    fields: f.clone().into(),
                 },
             )
             .await;
             match resp {
                 Ok(RpcResponse::AgentConfigUpdate) => Ok(()),
+                // An agent from before "keep the newest local copies" refuses
+                // the whole [backup] save over that one key — and with it the
+                // on/off switch it does understand. Resend without the key
+                // when leaving it out changes nothing on that node.
+                Ok(RpcResponse::Error(e))
+                    if backup_keep_unknown_to_old_node(&sect, &e.to_string()) =>
+                {
+                    match backup_fields_for_old_node(&f) {
+                        Some(f_old) => {
+                            match crate::dispatcher::dispatch_to_node(
+                                &st,
+                                Some(node_id.as_str()),
+                                Request::AgentConfigUpdate {
+                                    section: sect.to_string(),
+                                    fields: f_old.into(),
+                                },
+                            )
+                            .await
+                            {
+                                Ok(RpcResponse::AgentConfigUpdate) => Ok(()),
+                                Ok(RpcResponse::Error(e)) => {
+                                    Err(format!("{label} refused it ({e})"))
+                                }
+                                Ok(_) => Err(format!("{label} answered with something unexpected")),
+                                Err(e) => Err(format!("{label} could not be updated ({e})")),
+                            }
+                        }
+                        None => Err(format!(
+                            "{label} runs an older agent that cannot keep the newest local \
+                             copies, so it kept its previous setting — upgrade it, or set the \
+                             count to 0 to change dropping there"
+                        )),
+                    }
+                }
                 // An older agent that doesn't know these keys refuses the
                 // write; the operator needs to hear THAT, not "unreachable".
                 Ok(RpcResponse::Error(e)) => Err(format!("{label} refused it ({e})")),
@@ -1865,6 +1899,39 @@ async fn propagate_notifications(
     }
 }
 
+/// Did a node refuse a `[backup]` save only because it predates
+/// `keep_local_latest`? (Its config parser rejects unknown keys by name.)
+fn backup_keep_unknown_to_old_node(section: &str, error: &str) -> bool {
+    section == "backup" && error.contains("keep_local_latest")
+}
+
+/// The `[backup]` fields to send a node that predates `keep_local_latest`, or
+/// `None` when leaving the key out would change what that node does. An old
+/// node behaves as "keep 0", so the key can go when it says 0 (or nothing), or
+/// when dropping is being switched off. A keep count above 0 with dropping on
+/// must NOT be stripped: the old node would then drop the very copies the
+/// operator asked to keep.
+fn backup_fields_for_old_node(
+    fields: &std::collections::BTreeMap<String, String>,
+) -> Option<std::collections::BTreeMap<String, String>> {
+    let keep = fields
+        .get("keep_local_latest")
+        .map(|v| v.trim())
+        .unwrap_or("");
+    let drop_on = fields.get("drop_local_after_offsite").is_some_and(|v| {
+        matches!(
+            v.trim().to_ascii_lowercase().as_str(),
+            "true" | "on" | "1" | "yes"
+        )
+    });
+    if !(keep.is_empty() || keep == "0" || !drop_on) {
+        return None;
+    }
+    let mut f = fields.clone();
+    f.remove("keep_local_latest");
+    Some(f)
+}
+
 /// Operator-facing name for a config section.
 ///
 /// The redirect used to say "Section [backup_remote] saved", which is the name
@@ -1982,7 +2049,27 @@ pub async fn post_offsite_backfill(
                     "",
                 )
                 .await;
-            match hyperion_rpc_client::call(
+            // One blocking RPC that uploads and, with drop on, re-checks every
+            // site's local copies: heartbeat the job row so a long sweep is not
+            // reaped as stale (and its real result thrown away) mid-flight.
+            let hb = {
+                let reporter = reporter.clone();
+                tokio::spawn(async move {
+                    let mut pct = 5;
+                    loop {
+                        tokio::time::sleep(std::time::Duration::from_secs(120)).await;
+                        pct = (pct + 5).min(90);
+                        reporter
+                            .step(
+                                "Still working — copying off-site and re-checking local copies…",
+                                pct,
+                                "",
+                            )
+                            .await;
+                    }
+                })
+            };
+            let resp = hyperion_rpc_client::call(
                 &job_state.agent_socket,
                 Request::BackupOffsiteBackfill {
                     limit: BACKFILL_BATCH,
@@ -1990,8 +2077,9 @@ pub async fn post_offsite_backfill(
                     s3_targets,
                 },
             )
-            .await
-            {
+            .await;
+            hb.abort();
+            match resp {
                 Ok(RpcResponse::BackupOffsiteBackfill(r)) => {
                     let mut log = format!(
                         "considered: {}\npushed:     {}\nfailed:     {}\n",
@@ -2007,6 +2095,13 @@ pub async fn post_offsite_backfill(
                             r.kept_local,
                             if r.kept_local == 1 { "y" } else { "ies" },
                         ));
+                        if r.already_offsite > 0 {
+                            log.push_str(&format!(
+                                "            ({} of those were already off-site: re-checked \
+                                 there and dropped without being uploaded again)\n",
+                                r.already_offsite
+                            ));
+                        }
                     }
                     // Separated from `failed` because no retry fixes it: the
                     // archive was pruned off local disk before anything copied
@@ -2035,7 +2130,19 @@ pub async fn post_offsite_backfill(
                         );
                     }
                     reporter.step("Finished.", 100, &log).await;
-                    reporter.finish(r.failed == 0, None).await;
+                    // A kept copy is not a failure of the sweep, but with
+                    // "delete local" asked for it is not done either — say so
+                    // rather than show green over copies still on disk.
+                    let kept =
+                        (drop_local && r.kept_local > 0).then(|| {
+                            format!(
+                            "{} local cop{} kept — not confirmed off-site; each site's Backups \
+                             tab says why",
+                            r.kept_local,
+                            if r.kept_local == 1 { "y was" } else { "ies were" },
+                        )
+                        });
+                    reporter.finish(r.failed == 0 && kept.is_none(), kept).await;
                 }
                 Ok(RpcResponse::Error(e)) => reporter.finish(false, Some(e.to_string())).await,
                 Ok(_) => {
@@ -3321,6 +3428,48 @@ mod tests {
         flatten_toml_strings, letter_verdict, mask_secrets_in_toml,
         synthesize_unchecked_checkboxes, toml_key, toml_value,
     };
+
+    /// A node from before `keep_local_latest` gets the [backup] save without
+    /// it only when that cannot change what the node does.
+    #[test]
+    fn backup_fields_for_old_node_strips_only_when_harmless() {
+        use super::{backup_fields_for_old_node, backup_keep_unknown_to_old_node};
+        let m = |pairs: &[(&str, &str)]| -> std::collections::BTreeMap<String, String> {
+            pairs
+                .iter()
+                .map(|(k, v)| (k.to_string(), v.to_string()))
+                .collect()
+        };
+        assert!(backup_keep_unknown_to_old_node(
+            "backup",
+            "validation: field `keep_local_latest` is not editable in section `backup`"
+        ));
+        assert!(!backup_keep_unknown_to_old_node("backup", "something else"));
+        assert!(!backup_keep_unknown_to_old_node(
+            "snapshots",
+            "keep_local_latest"
+        ));
+
+        // keep 0 = what the old node does anyway → strip.
+        let f = backup_fields_for_old_node(&m(&[
+            ("drop_local_after_offsite", "true"),
+            ("keep_local_latest", "0"),
+        ]))
+        .expect("harmless");
+        assert_eq!(f, m(&[("drop_local_after_offsite", "true")]));
+        // Switching dropping OFF must reach it whatever the count says.
+        assert!(backup_fields_for_old_node(&m(&[
+            ("drop_local_after_offsite", "false"),
+            ("keep_local_latest", "3"),
+        ]))
+        .is_some());
+        // Dropping on with a keep count: stripping would drop the kept copies.
+        assert!(backup_fields_for_old_node(&m(&[
+            ("drop_local_after_offsite", "TRUE"),
+            ("keep_local_latest", "3"),
+        ]))
+        .is_none());
+    }
     use std::collections::BTreeMap;
 
     /// The fork guard must survive a `<textarea>`.
diff --git a/bin/hyperion-web/templates/hostings_detail.html b/bin/hyperion-web/templates/hostings_detail.html
index e657850a..0382d247 100644
--- a/bin/hyperion-web/templates/hostings_detail.html
+++ b/bin/hyperion-web/templates/hostings_detail.html
@@ -3259,7 +3259,8 @@ <h2>
       {% endif %}
     </div>
     <p class="note" style="margin-top:0.8rem">
-      How long archives and snapshots are kept, which kinds this node makes at all, and the FTP
+      How long archives and snapshots are kept, whether the local copy is deleted once it is
+      verified off-site, which kinds this node makes at all, and the FTP
       off-site target are set in <a href="/settings#backups">Settings → Backups &amp; trash</a>; S3 targets in
       <a href="/settings/backups">Settings → Backup targets</a>.
     </p>
@@ -3312,11 +3313,11 @@ <h2>
        delete form's. #}
     <button type="button" class="btn small" id="bulk-offsite-btn" disabled
             onclick="hyBulkOffsiteSubmit()"
-            title="Copy the selected backups off-site, then delete the local copies once verified">Off-site &amp; delete local</button>
+            title="Delete the local copies of the selected backups once each is confirmed off-site — uploading it first only if it is not there yet">Off-site &amp; delete local</button>
   </form>
   <form id="bulk-offsite-form" method="post" action="/hostings/backups/offsite-drop"
         data-confirm-title="Copy selected off-site, then delete local"
-        data-confirm-body="Each selected backup is uploaded to the configured off-site targets, then its local archive and database dump are deleted ONLY after an independent re-verify that the copy is really off-site. A copy that cannot be confirmed off-site is kept. The off-site copies remain and can still be restored. Runs as a background job."
+        data-confirm-body="A selected backup that is already off-site is re-checked there; any other is uploaded to the configured off-site targets first. Its local archive and database dump are then deleted ONLY after an independent re-verify that the copy is really off-site. A copy that cannot be confirmed off-site is kept. The off-site copies remain and can still be restored. Runs as a background job."
         data-confirm-confirm-label="Copy off-site &amp; delete local"
         data-confirm-variant="danger"
         style="display:none">
@@ -3395,6 +3396,16 @@ <h2>
      refresh re-renders only this region from the full page, and nothing in it
      is processed by htmx again afterwards: keep it to plain forms. #}
   <div id="backups-live" data-live-refresh="15">
+  {% if crate::handlers::hostings::backups_kept_by_setting(backups.as_slice()) %}
+    <p class="note" style="margin:0 0 0.6rem">
+      Backups already off-site (<em>uploaded</em> or <em>off-site ✓</em>) still keep their local copy
+      on this site's node, because <strong>Delete the local copy once it is verified off-site</strong> is
+      off there. Turn it on in
+      <a href="/settings#local-copies">Settings → Backups &amp; trash → Local backup copies</a> and this
+      site's copies are dropped after its next archive backup (scheduled, or <em>Back up now</em>) — or use
+      <em>Off-site &amp; drop</em> on a row now.
+    </p>
+  {% endif %}
   {% if backups.is_empty() %}
     <p class="note">No archives yet. <em>Back up now</em> makes the first one.</p>
   {% else %}
@@ -3424,10 +3435,16 @@ <h2>
                 back at the right size. An em dash means we have no record. -#}
             <td>
               <span class="{{ b.offsite_label().1 }}" style="font-size:0.6rem"
-                    title="{% if !b.remote_error.is_empty() %}{{ b.remote_error }}{% else if !b.remote_blob_key.is_empty() %}{{ b.remote_blob_key }}{% else %}No off-site copy is recorded for this backup{% endif %}">{{ b.offsite_label().0 }}</span>
+                    title="{% if !b.remote_error.is_empty() %}{{ b.remote_error }}{% else if !b.remote_blob_key.is_empty() %}{{ b.remote_blob_key }}{% else if !b.s3_ok_targets.is_empty() %}Pushed in full to S3: {{ b.s3_ok_targets.join(", ") }}{% else %}No off-site copy is recorded for this backup{% endif %}">{{ b.offsite_label().0 }}</span>
               {%- if !b.sha256_hex.is_empty() %}
               <span class="cell-sub" style="font-size:0.6rem" title="Content digest recorded when the archive was made: {{ b.sha256_hex }}">fingerprinted</span>
               {%- endif %}
+              {#- Why the local copy is still here although it is off-site —
+                  so "off-site ✓" beside a local path never reads as a delete
+                  that silently failed. Reason from the OWNING node. -#}
+              {%- if !b.local_kept.is_empty() %}
+              <span class="cell-sub" style="font-size:0.6rem{% if b.local_kept == "unconfirmed" %};color:var(--warn){% endif %}" title="{{ b.local_note }}">{{ b.local_kept_label() }}</span>
+              {%- endif %}
             </td>
             <td class="right muted numeric">{{ crate::handlers::stats::fmt_bytes(b.bytes_total) }}</td>
             <td>
@@ -3472,13 +3489,13 @@ <h2>
                    leave the node. #}
                 <form method="post" action="/hostings/backups/offsite-drop" style="display:inline"
                       data-confirm-title="Copy off-site, then delete local"
-                      data-confirm-body="This backup is uploaded to the configured off-site targets, then its local archive{% if b.db_dump_path.is_some() %} and database dump{% endif %} are deleted ONLY after an independent re-verify that the copy is really off-site. If it cannot be confirmed off-site, the local copy is kept. Runs as a background job."
+                      data-confirm-body="{% if b.remote_state == "verified" || b.remote_state == "ok" || !b.s3_ok_targets.is_empty() %}This backup is already off-site: it is re-checked there (and uploaded again only if that fails){% else %}This backup is uploaded to the configured off-site targets{% endif %}, then its local archive{% if b.db_dump_path.is_some() %} and database dump{% endif %} are deleted ONLY after an independent re-verify that the copy is really off-site. If it cannot be confirmed off-site, the local copy is kept. Runs as a background job."
                       data-confirm-confirm-label="Copy off-site &amp; delete local"
                       data-confirm-variant="danger">
                   <input type="hidden" name="_csrf" value="{{ csrf_token }}">
                   <input type="hidden" name="selector" value="{{ detail.id.as_str() }}">
                   <input type="hidden" name="backup_ids" value="{{ b.id }}">
-                  <button class="btn small" type="submit" title="Copy off-site, then delete the local copy">Off-site &amp; drop</button>
+                  <button class="btn small" type="submit" title="Delete the local copy once it is confirmed off-site — uploading it first only if it is not there yet">Off-site &amp; drop</button>
                 </form>
                 {% endif %}
                 {% if b.state != "running" %}
diff --git a/bin/hyperion-web/templates/settings.html b/bin/hyperion-web/templates/settings.html
index cffadb47..e35b38a1 100644
--- a/bin/hyperion-web/templates/settings.html
+++ b/bin/hyperion-web/templates/settings.html
@@ -1808,17 +1808,29 @@ <h3>
                {% if config.backup.drop_local_after_offsite %}checked{% endif %}>
         Delete the local copy once it is verified off-site
       </label>
+      <div class="field" style="margin:0.7rem 0 0">
+        <label for="keep_local_latest">Keep the newest local copies anyway <span class="hint">per site, 0 = keep none</span></label>
+        <input type="number" id="keep_local_latest" name="keep_local_latest" min="0" max="1000" step="1"
+               value="{{ config.backup.keep_local_latest }}" style="max-width:8rem">
+      </div>
       <p class="text-soft small" style="margin:0.5rem 0 0.8rem;line-height:1.55">
-        After each backup, the local archive and database dump are deleted
-        <strong>only when the off-site copy has been re-checked and confirmed
-        present</strong> — never on a mere "upload finished". If a file cannot
-        be confirmed off-site, the local copy is kept and a warning is logged.
-        Restore then comes from the off-site copy via the site's
-        <strong>Off-site</strong> panel. A run with no off-site destination is
-        never touched. <strong>Off by default</strong>: keeping the local copy
-        means a faster restore and a second copy, at the cost of disk.
-        To do the same once for backups already on disk, use
-        <a href="#offsite-backfill">Copy existing backups off-site</a> at the end of this tab.
+        After each backup of a site, its local archives and database dumps are
+        deleted — this backup's and any older one already off-site, except the
+        newest copies kept above — <strong>only once each off-site copy has been
+        re-checked and confirmed present</strong>, never on a mere "upload
+        finished". A copy that cannot be confirmed is kept, and the site's
+        Backups tab says why. Restore then comes from the off-site copy via the
+        site's <strong>Off-site</strong> panel. A node with no off-site
+        destination never deletes anything. <strong>Off by default</strong>:
+        keeping the local copy means a faster restore and a second copy, at the
+        cost of disk. Turning it on frees a site's existing copies after its
+        next archive backup, on whichever node owns it. To do it now for the
+        sites on this node, use
+        <a href="#offsite-backfill">Copy off-site &amp; delete local</a> at the
+        end of this tab; for a site on another node, <em>Off-site &amp; drop</em>
+        on that site's Backups tab. A node running an older agent ignores the
+        keep count; if dropping is on there, it does not take a count above 0
+        until it is upgraded.
       </p>
       <div class="item-actions"><button type="submit" class="btn primary">Save</button></div>
     </form>
@@ -1970,13 +1982,17 @@ <h3 style="margin:0">
        confirmed is kept, so this never removes the only copy. #}
     <p class="text-soft small" style="margin:0.9rem 0 0.6rem;line-height:1.55">
       Short on disk? The same sweep can <strong>delete each local copy</strong>
-      once it has been independently re-verified off-site. A copy that cannot be
-      confirmed (missing, wrong size, or the target is unreachable) is
-      <strong>kept</strong> — this never deletes the only copy.
+      once it has been independently re-verified off-site — including the
+      copies that were <strong>already off-site</strong>, which are re-checked
+      where they are rather than uploaded again. Each site's newest copies set
+      under <a href="#local-copies">Local backup copies</a> stay. A copy that
+      cannot be confirmed (missing, wrong size, or the target is unreachable) is
+      <strong>kept</strong> — this never deletes the only copy. Both buttons
+      cover the backups stored on <strong>this</strong> node.
     </p>
     <form method="post" action="/settings/backups/backfill?drop=1"
           data-confirm-title="Copy off-site, then delete local"
-          data-confirm-body="Uploads backups that have no off-site copy, then DELETES each local archive and database dump once it is independently re-verified present off-site. A copy that cannot be confirmed off-site is kept. The off-site copy remains and can still be restored. This transfers real data and can take a long time."
+          data-confirm-body="Uploads backups that have no off-site copy, then DELETES each local archive and database dump — of those and of backups already off-site — once it is independently re-verified present off-site. Each site's newest local copies set under Local backup copies stay. A copy that cannot be confirmed off-site is kept. The off-site copy remains and can still be restored. This transfers real data and can take a long time."
           data-confirm-variant="danger"
           data-confirm-confirm-label="Copy, then delete local">
       <input type="hidden" name="_csrf" value="{{ csrf_token }}">
diff --git a/crates/hyperion-adapters/src/backup.rs b/crates/hyperion-adapters/src/backup.rs
index aa303f7f..d0efac65 100644
--- a/crates/hyperion-adapters/src/backup.rs
+++ b/crates/hyperion-adapters/src/backup.rs
@@ -633,6 +633,10 @@ pub async fn verify_remote(
             "fail\n",
             "silent\n",
             "show-error\n",
+            // A host that drops packets would otherwise hold every re-check
+            // for the full max-time; the drop-local sweep asks about several
+            // files in a row, and the connection probe already uses 15 s.
+            "connect-timeout = 15\n",
             "max-time = 60\n",
             "write-out = \"%{{size_download}} %{{size_upload}} %{{filename_effective}}\"\n",
         ),
diff --git a/crates/hyperion-core/src/service.rs b/crates/hyperion-core/src/service.rs
index f1455899..0bff0e9a 100644
--- a/crates/hyperion-core/src/service.rs
+++ b/crates/hyperion-core/src/service.rs
@@ -6283,8 +6283,9 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         // A rollback snapshot exists to be a LOCAL copy to roll back to. Mark
         // it never-off-site the moment its row exists, so the on-demand
         // "copy off-site, then delete local" action can never push it away or
-        // drop the local copy. The fresh-backup path below already skips its
-        // own push/drop for NotWanted; this protects it from the LATER paths.
+        // drop the local copy. The fresh-backup path below skips its own FTP
+        // push, S3 push and local drop for NotWanted; this protects it from the
+        // LATER paths.
         if offsite == OffsiteSource::NotWanted {
             if let Err(e) = hyperion_state::backups::mark_no_offsite(&self.pool, run_id).await {
                 tracing::warn!(error = %e, "could not mark rollback snapshot no_offsite");
@@ -6295,6 +6296,10 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         let archive_dir = std::path::PathBuf::from(&backup_root).join(&detail.system_user);
         let archive_name = format!("{}-{}.tar.gz", detail.domain, ts);
         let archive_path = archive_dir.join(&archive_name);
+        // This run's archive is busy until its own push is done: a backup of
+        // the same site finishing meanwhile must not drop it from under the
+        // upload. Released just before this run's own drop step below.
+        let archive_busy = ArchiveInUse::claim(&archive_path);
         let db_dump_path = detail
             .database
             .as_ref()
@@ -6473,7 +6478,15 @@ impl<A: AdapterPort + 'static> HostingService<A> {
 
                 // Optional remote push. Failures don't roll back the
                 // local backup row — operator still has the local copy.
-                if let Some(remote) = &self.remote_backup {
+                // Never for a rollback snapshot (`NotWanted`): its whole
+                // purpose is a LOCAL copy to roll back to, and the S3 push and
+                // the local drop below already leave it alone — the FTP push
+                // used to be the one path that still sent it away.
+                if let Some(remote) = self
+                    .remote_backup
+                    .as_ref()
+                    .filter(|_| offsite != OffsiteSource::NotWanted)
+                {
                     let hosting_dir = format!(
                         "{}/{}",
                         remote.base_path.trim_end_matches('/'),
@@ -6520,41 +6533,36 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                     // different words: `ok` versus `verified`.
                     if ok {
                         // Upload returned success — the copy landed, unless the
-                        // re-verify below positively contradicts it.
+                        // re-verify below positively contradicts it. Both files
+                        // are checked: the dump is half the backup, and
+                        // "off-site ✓" must mean what the drop step will later
+                        // demand before it deletes anything.
                         offsite_ok = true;
-                        match hyperion_adapters::backup::verify_remote(&archive_path, &upload).await
-                        {
-                            Ok(Some(true)) => {
+                        let (state, note) =
+                            ftp_verify_run(&archive_path, db_dump_path.as_deref(), &upload).await;
+                        match state {
+                            "verified" => {
                                 let _ = hyperion_state::backups::set_remote(
                                     &self.pool, run_id, &blob_key, "verified", "",
                                 )
                                 .await;
                             }
-                            Ok(Some(false)) => {
-                                // We LOOKED and it is not there at the right
-                                // size — that is a failed off-site copy.
+                            "failed" => {
+                                // We LOOKED and a file is not there at the
+                                // right size — that is a failed off-site copy.
                                 offsite_ok = false;
                                 let _ = hyperion_state::backups::set_remote(
-                                    &self.pool,
-                                    run_id,
-                                    &blob_key,
-                                    "failed",
-                                    "uploaded, but the remote copy is missing or the wrong size",
+                                    &self.pool, run_id, &blob_key, "failed", &note,
                                 )
                                 .await;
-                                tracing::warn!(domain=%detail.domain,
-                                    "remote backup: upload reported success but the file is not \
+                                tracing::warn!(domain=%detail.domain, note=%note,
+                                    "remote backup: upload reported success but a file is not \
                                      there at the right size");
                             }
-                            // Could not LOOK is not the same as failed, and
-                            // there are two ways not to look: the server gave
-                            // no readable size, or we could not reach it. The
-                            // row stays `ok` in both — exactly as strong a
-                            // claim as the evidence supports.
-                            Ok(None) => tracing::debug!(domain=%detail.domain,
-                                "remote backup: the server gave no size to check against"),
-                            Err(e) => tracing::warn!(domain=%detail.domain, error=%e,
-                                "remote backup: could not verify the uploaded copy"),
+                            // Could not LOOK is not the same as failed. The row
+                            // stays `ok` — exactly as strong a claim as the
+                            // evidence supports.
+                            _ => {}
                         }
                     }
                     self.append_audit(
@@ -6662,9 +6670,14 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 }
 
                 // At least one S3 target whose push FULLY succeeded also counts
-                // the off-site copy as landed.
+                // the off-site copy as landed — and is recorded on the run,
+                // because the S3 push writes no `remote_state`: without it an
+                // S3-only backup is off-site with nothing on its row to say so.
                 if !s3_push_ok.is_empty() {
                     offsite_ok = true;
+                    let names: Vec<String> = s3_push_ok.iter().cloned().collect();
+                    let _ = hyperion_state::backups::set_s3_ok_targets(&self.pool, run_id, &names)
+                        .await;
                 }
                 if will_offsite {
                     if offsite_ok {
@@ -6687,26 +6700,34 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                     }
                 }
 
-                // Drop the local copy once it is VERIFIED off-site (global
-                // opt-in, off by default). Never for `NotWanted` runs — those
-                // are the pre-change rollback snapshots, whose whole purpose is
-                // a LOCAL copy to roll back to; they were never pushed
-                // off-site, so dropping them would delete the only copy. The
-                // step re-verifies each local file independently before it
-                // deletes anything.
-                if offsite != OffsiteSource::NotWanted
-                    && read_backup_drop_local(self.agent_config_path.as_deref())
-                {
-                    let _ = self
-                        .maybe_drop_local_after_offsite(
-                            &detail,
-                            run_id,
-                            &archive_path,
-                            db_dump_path.as_deref(),
-                            &s3_pushed_targets,
-                            &s3_push_ok,
-                        )
-                        .await;
+                // Drop local copies once they are VERIFIED off-site (global
+                // opt-in, off by default) — this run's, and any older local
+                // copy of this site that is on record as off-site, past the
+                // newest `keep_local_latest` the node keeps. So switching the
+                // option on frees a site's older copies at its next backup
+                // instead of only ever acting on new ones. Never for
+                // `NotWanted` runs — those are the pre-change rollback
+                // snapshots, whose whole purpose is a LOCAL copy to roll back
+                // to; they were never pushed off-site, so dropping them would
+                // delete the only copy (and the sweep skips their rows too).
+                // Every copy is re-verified independently before it goes.
+                drop(archive_busy);
+                if offsite != OffsiteSource::NotWanted {
+                    let policy = read_local_copy_policy(self.agent_config_path.as_deref());
+                    if policy.drop {
+                        let evidence: std::collections::HashMap<
+                            i64,
+                            std::collections::HashSet<String>,
+                        > = std::iter::once((run_id, s3_push_ok.clone())).collect();
+                        let _ = self
+                            .enforce_local_copies(
+                                &detail,
+                                policy.keep_latest,
+                                &s3_pushed_targets,
+                                &evidence,
+                            )
+                            .await;
+                    }
                 }
             }
             Err(e) => {
@@ -6875,33 +6896,204 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         .await;
     }
 
-    /// Delete the LOCAL copy of a just-made backup — but ONLY after every
-    /// local file it would delete has been INDEPENDENTLY re-verified present
-    /// off-site. This is the whole of the "drop local once verified off-site"
-    /// option, and the one place data can be lost if it is wrong, so it never
-    /// trusts the run's `remote_state` (which only the FTP path ever writes to
-    /// "verified" anyway): it re-checks each file against the destinations this
-    /// run actually used.
+    /// Apply the drop-local option to ONE site: keep its newest `keep_latest`
+    /// local copies, and drop the local copy of every older backup that is
+    /// INDEPENDENTLY re-verified off-site (see `local_copies_to_drop` for which
+    /// rows qualify). Returns each attempted run with what happened to it.
+    ///
+    /// `push_evidence` holds the runs pushed moments ago by the caller (the
+    /// backup that just finished, or a backfill's uploads), mapped to the S3
+    /// targets each push FULLY succeeded to. Those runs are candidates even
+    /// before their row is updated, and — merged with the targets the row
+    /// itself records (`s3_ok_targets`) — the target set is what lets an
+    /// age-encrypted target confirm a copy (see `file_is_offsite`). Anything
+    /// else is confirmed by FTP size or unencrypted S3 size alone — which is the
+    /// point: a copy that is already off-site is dropped without being sent
+    /// again.
+    ///
+    /// Stops at the first run whose off-site copy could not be LOOKED at
+    /// (every destination failed to answer): the next run would ask the same
+    /// unreachable host and wait out the same timeouts, and a scheduled sweep
+    /// runs sites one after another. The next backup tries again.
+    async fn enforce_local_copies(
+        &self,
+        detail: &hyperion_types::HostingDetail,
+        keep_latest: usize,
+        s3_targets: &[&hyperion_types::S3BackupTarget],
+        push_evidence: &std::collections::HashMap<i64, std::collections::HashSet<String>>,
+    ) -> Vec<(i64, DropLocalOutcome)> {
+        let rows = match hyperion_state::backups::list_for(&self.pool, &detail.id, 1000).await {
+            Ok(r) => r,
+            Err(e) => {
+                tracing::warn!(domain = %detail.domain, error = %e,
+                    "drop-local: could not list this site's backups — keeping every local copy");
+                return Vec::new();
+            }
+        };
+        let just_pushed: std::collections::HashSet<i64> = push_evidence.keys().copied().collect();
+        let mut done = Vec::new();
+        for id in local_copies_to_drop(&rows, keep_latest, &just_pushed) {
+            let Some(run) = rows.iter().find(|r| r.id == id) else {
+                continue;
+            };
+            let mut evidence: std::collections::HashSet<String> =
+                run.s3_ok_targets.iter().cloned().collect();
+            if let Some(more) = push_evidence.get(&id) {
+                evidence.extend(more.iter().cloned());
+            }
+            let outcome = self
+                .drop_run_local_if_offsite(
+                    detail,
+                    run,
+                    s3_targets,
+                    &evidence,
+                    Some(&run.local_note),
+                )
+                .await;
+            done.push((id, outcome));
+            // Nowhere off-site to look, or nobody answered: no other run of
+            // this site will fare better right now.
+            if matches!(
+                outcome,
+                DropLocalOutcome::NoDestination | DropLocalOutcome::Unreachable
+            ) {
+                break;
+            }
+        }
+        done
+    }
+
+    /// Hand one EXISTING run's local files to the verified-drop gate.
     ///
-    /// The archive and the DB dump are the only files it touches — the tiny
-    /// manifest.json stays on local disk, because the FTP transport does not
-    /// push it, so deleting it could remove the only copy.
-    /// The verified-drop step re-verifies each local file INDEPENDENTLY off-site
-    /// and, only when every one is confirmed, clears the DB paths then deletes
-    /// the files. `run_id` names the row whose local paths are cleared first so
-    /// a crash mid-delete leaves a harmless orphan, never a row pointing at a
-    /// gone file.
+    /// * A run some operation on this node is using right now — a restore
+    ///   reading it, a backup or a push still sending it — is left alone
+    ///   (`Busy`): deleting it would cut that operation off part-way.
+    /// * Only the files still on disk are offered: a dump that was removed
+    ///   separately has nothing left to lose, and asking the remote about a
+    ///   file we cannot even stat would keep the archive forever.
+    /// * An archive that is already gone (removed by hand, lost with a disk)
+    ///   is not a drop: if its dump is gone too, the row is set straight —
+    ///   the local paths are cleared, since there is no local copy left to
+    ///   protect — and the run is reported `MissingLocally`, never as a copy
+    ///   that was "kept". If the dump is still there, the dump alone goes
+    ///   through the gate.
+    async fn drop_run_local_if_offsite(
+        &self,
+        detail: &hyperion_types::HostingDetail,
+        run: &hyperion_state::backups::BackupRun,
+        s3_targets: &[&hyperion_types::S3BackupTarget],
+        s3_push_ok: &std::collections::HashSet<String>,
+        record_keep: Option<&str>,
+    ) -> DropLocalOutcome {
+        // Defence in depth: the callers already skip these, but this is the
+        // one door every sweep goes through.
+        if run.no_offsite || run.state != "ok" {
+            return DropLocalOutcome::Kept;
+        }
+        let Some(archive) = run.archive_path.as_deref().map(std::path::Path::new) else {
+            return DropLocalOutcome::Kept;
+        };
+        if archive_in_use(archive) {
+            return DropLocalOutcome::Busy;
+        }
+        // Exists / gone / could-not-look are three answers; only a definite
+        // "gone" licenses setting the row straight.
+        let archive_here = match tokio::fs::try_exists(archive).await {
+            Ok(b) => b,
+            Err(_) => return DropLocalOutcome::Kept,
+        };
+        let dump = match run.db_dump_path.as_deref().map(std::path::Path::new) {
+            Some(p) => match tokio::fs::try_exists(p).await {
+                Ok(true) => Some(p),
+                Ok(false) => None,
+                Err(_) => return DropLocalOutcome::Kept,
+            },
+            None => None,
+        };
+        let mut files: Vec<(&str, &std::path::Path)> = Vec::with_capacity(2);
+        if archive_here {
+            files.push(("archive", archive));
+        }
+        if let Some(d) = dump {
+            files.push(("database dump", d));
+        }
+        if files.is_empty() {
+            // Nothing of this run is on disk any more. The row still says
+            // otherwise; make it say what is true, so it stops being offered
+            // as a local copy (and stops reading "kept" on every sweep).
+            if hyperion_state::backups::clear_local_paths(&self.pool, run.id)
+                .await
+                .is_ok()
+            {
+                if let Some(m) = manifest_path_for(archive) {
+                    let _ = tokio::fs::remove_file(m).await;
+                }
+                self.append_audit(
+                    "hosting.backup.drop_local",
+                    Some(detail.id.as_str()),
+                    &serde_json::json!({
+                        "run_id": run.id,
+                        "note": "the local copy was already gone from disk; the row no longer \
+                                 lists it (the off-site copy on record is untouched)"
+                    })
+                    .to_string(),
+                    "ok",
+                )
+                .await;
+            }
+            return DropLocalOutcome::MissingLocally;
+        }
+        self.maybe_drop_local_after_offsite(
+            detail,
+            run.id,
+            archive,
+            &files,
+            s3_targets,
+            s3_push_ok,
+            record_keep,
+        )
+        .await
+    }
+
+    /// Delete the LOCAL copy of a backup — but ONLY after every local file it
+    /// would delete has been INDEPENDENTLY re-verified present off-site. This
+    /// is the whole of the "drop local once verified off-site" option, and the
+    /// one place data can be lost if it is wrong, so it never trusts the run's
+    /// `remote_state`: it re-checks each file against the destinations it is
+    /// handed.
+    ///
+    /// `files` are what is verified and deleted (the archive and/or the DB
+    /// dump, labelled). `archive_path` is the run's archive, used only to find
+    /// its `.manifest.json`, which goes with them: nothing ever reads it back
+    /// (it is a write-only description of the run, and the run's row keeps the
+    /// same facts), so once the archive it describes is gone from this node it
+    /// is only an orphan that no prune can find again.
+    ///
+    /// Only when every file is confirmed does it clear the DB paths and then
+    /// delete the files. `run_id` names the row whose local paths are cleared
+    /// first so a crash mid-delete leaves a harmless orphan, never a row
+    /// pointing at a gone file. Checking stops at the first file that is not
+    /// confirmed — one is enough to keep the copy.
+    ///
+    /// `record_keep` says what to do when the copy is KEPT: `None` is a silent
+    /// probe (the caller has a fallback, e.g. push again and retry, so a
+    /// refusal here is not news); `Some(prev)` writes the reason onto the row,
+    /// a warning and an audit row — the last two only when the reason differs
+    /// from `prev`, the row's current note, so a copy that stays unconfirmed is
+    /// not re-reported after every backup.
+    #[allow(clippy::too_many_arguments)]
     async fn maybe_drop_local_after_offsite(
         &self,
         detail: &hyperion_types::HostingDetail,
         run_id: i64,
         archive_path: &std::path::Path,
-        db_dump_path: Option<&std::path::Path>,
+        files: &[(&str, &std::path::Path)],
         s3_targets: &[&hyperion_types::S3BackupTarget],
         s3_push_ok: &std::collections::HashSet<String>,
+        record_keep: Option<&str>,
     ) -> DropLocalOutcome {
-        // The FTP destination this run pushed to, if any. Rebuilt here from the
-        // same inputs the push used rather than threaded through, so the
+        // The FTP destination, if this node has one. Rebuilt here from the
+        // same inputs the push uses rather than threaded through, so the
         // borrow stays local to this step.
         let ftp = self.remote_backup.as_ref().map(|remote| {
             let hosting_dir = format!(
@@ -6911,8 +7103,8 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             );
             (remote, hosting_dir)
         });
-        // A destination has to have been used, or there is nothing off-site to
-        // fall back on — never delete the only copy.
+        // A destination has to exist, or there is nothing off-site to fall
+        // back on — never delete the only copy.
         let used_offsite = ftp.is_some() || !s3_targets.is_empty();
         if !used_offsite {
             return DropLocalOutcome::NoDestination;
@@ -6920,36 +7112,51 @@ impl<A: AdapterPort + 'static> HostingService<A> {
 
         // Keys live under <system_user>/ , same prefix the S3 push used.
         let prefix = format!("{}/", detail.system_user);
-        let mut local_files: Vec<&std::path::Path> = vec![archive_path];
-        if let Some(p) = db_dump_path {
-            local_files.push(p);
-        }
-        let mut confirmed: Vec<bool> = Vec::with_capacity(local_files.len());
-        for f in &local_files {
-            confirmed.push(
-                self.file_is_offsite(f, &prefix, ftp.as_ref(), s3_targets, s3_push_ok)
-                    .await,
-            );
+        let mut confirmed: Vec<bool> = Vec::with_capacity(files.len());
+        let mut first_unconfirmed: Option<(&str, OffsiteCheck)> = None;
+        for (label, f) in files {
+            let check = self
+                .file_is_offsite(f, &prefix, ftp.as_ref(), s3_targets, s3_push_ok)
+                .await;
+            confirmed.push(check == OffsiteCheck::Confirmed);
+            if check != OffsiteCheck::Confirmed {
+                first_unconfirmed = Some((label, check));
+                break;
+            }
         }
 
-        if !may_drop_local_after_offsite(used_offsite, &confirmed) {
-            tracing::warn!(
-                domain = %detail.domain,
-                "drop-local: keeping the local backup — could not confirm every file is off-site \
-                 (missing, wrong size, or unreachable to re-check)"
-            );
-            self.append_audit(
-                "hosting.backup.drop_local",
-                Some(detail.id.as_str()),
-                &serde_json::json!({
-                    "note": "drop-local is on, but not every file was confirmed off-site \
-                             — local copy kept"
-                })
-                .to_string(),
-                "failed",
-            )
-            .await;
-            return DropLocalOutcome::Kept;
+        if !may_drop_local_after_offsite(used_offsite, &confirmed) || first_unconfirmed.is_some() {
+            let unreachable = matches!(first_unconfirmed, Some((_, OffsiteCheck::Unreachable)));
+            let outcome = if unreachable {
+                DropLocalOutcome::Unreachable
+            } else {
+                DropLocalOutcome::Kept
+            };
+            let Some(prev) = record_keep else {
+                return outcome;
+            };
+            let what: Vec<&str> = first_unconfirmed.map(|(l, _)| l).into_iter().collect();
+            let note = local_kept_unconfirmed_note(&what);
+            if prev != note {
+                tracing::warn!(
+                    domain = %detail.domain,
+                    run_id,
+                    note = %note,
+                    "drop-local: keeping the local backup — could not confirm every file is off-site"
+                );
+                let _ = hyperion_state::backups::set_local_note(&self.pool, run_id, &note).await;
+                self.append_audit(
+                    "hosting.backup.drop_local",
+                    Some(detail.id.as_str()),
+                    &serde_json::json!({ "run_id": run_id, "note": note }).to_string(),
+                    "failed",
+                )
+                .await;
+            } else {
+                tracing::debug!(domain = %detail.domain, run_id,
+                    "drop-local: still not confirmed off-site (unchanged)");
+            }
+            return outcome;
         }
 
         // Every file is confirmed off-site. Clear the DB paths FIRST, then
@@ -6971,7 +7178,8 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         // only a harmless orphan file that retention can no longer see (its row
         // does not name it) — not data loss, but worth a line so the wasted
         // disk is explainable rather than mysterious.
-        for f in std::iter::once(archive_path).chain(db_dump_path) {
+        let manifest = manifest_path_for(archive_path);
+        for f in files.iter().map(|(_, f)| *f).chain(manifest.as_deref()) {
             if let Err(e) = tokio::fs::remove_file(f).await {
                 if e.kind() != std::io::ErrorKind::NotFound {
                     tracing::warn!(
@@ -6984,12 +7192,14 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         }
         tracing::info!(
             domain = %detail.domain,
+            run_id,
             "drop-local: removed the local backup copy — verified off-site"
         );
         self.append_audit(
             "hosting.backup.drop_local",
             Some(detail.id.as_str()),
             &serde_json::json!({
+                "run_id": run_id,
                 "note": "local copy removed after the off-site copy was verified"
             })
             .to_string(),
@@ -7000,10 +7210,13 @@ impl<A: AdapterPort + 'static> HostingService<A> {
     }
 
     /// Is one local backup file INDEPENDENTLY confirmed present off-site, on
-    /// any destination this run used? A conservative predicate for the
-    /// drop-local gate: anything short of a positive confirmation — absent,
-    /// wrong size, or simply unreachable to check — is `false`, which keeps
-    /// the local copy.
+    /// any destination handed in? A conservative predicate for the drop-local
+    /// gate: only `Confirmed` licenses a delete. The other two answers both
+    /// keep the local copy and differ only in what the caller does next:
+    /// `NotConfirmed` means a destination ANSWERED (absent, wrong size, no size
+    /// given) or was not asked; `Unreachable` means every destination that was
+    /// asked failed to answer at all, so the next file on the same host would
+    /// too.
     ///
     /// Two data-safety rules live here:
     ///   * FTP is verified by size (`verify_remote`), and only `Ok(Some(true))`
@@ -7012,11 +7225,13 @@ impl<A: AdapterPort + 'static> HostingService<A> {
     ///     has an age recipient, so an ENCRYPTED object is confirmed by
     ///     EXISTENCE only (its size cannot match the plaintext) — but existence
     ///     alone can't tell a whole ciphertext from a truncated one, so an age
-    ///     target is trusted ONLY when this run's push to it FULLY succeeded
-    ///     (`s3_push_ok`): a partial age stream returns `Err` from `upload_s3`,
-    ///     so it never lands in that set. An UNENCRYPTED object must match the
-    ///     local byte count exactly, which catches truncation directly, so it
-    ///     needs no such pairing.
+    ///     target is trusted ONLY when a push of this run to it is on record as
+    ///     having FULLY succeeded (`s3_push_ok`: this process's push, or the
+    ///     run's stored `s3_ok_targets`): a partial age stream returns `Err`
+    ///     from `upload_s3`, so it never lands in that set, and a failed
+    ///     re-push removes the target from the stored list. An UNENCRYPTED
+    ///     object must match the local byte count exactly, which catches
+    ///     truncation directly, so it needs no such pairing.
     async fn file_is_offsite(
         &self,
         file: &std::path::Path,
@@ -7024,7 +7239,9 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         ftp: Option<&(&RemoteBackupConfig, String)>,
         s3_targets: &[&hyperion_types::S3BackupTarget],
         s3_push_ok: &std::collections::HashSet<String>,
-    ) -> bool {
+    ) -> OffsiteCheck {
+        let mut asked = 0usize;
+        let mut answered = 0usize;
         // FTP first — cheapest, and it verifies by size on its own.
         if let Some((remote, hosting_dir)) = ftp {
             let upload = hyperion_adapters::backup::RemoteUpload {
@@ -7035,8 +7252,11 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 password: &remote.password,
                 remote_dir: hosting_dir,
             };
-            if let Ok(Some(true)) = hyperion_adapters::backup::verify_remote(file, &upload).await {
-                return true;
+            asked += 1;
+            match hyperion_adapters::backup::verify_remote(file, &upload).await {
+                Ok(Some(true)) => return OffsiteCheck::Confirmed,
+                Ok(_) => answered += 1,
+                Err(_) => {}
             }
         }
 
@@ -7046,7 +7266,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         if !s3_targets.is_empty() {
             let local_len = match tokio::fs::metadata(file).await {
                 Ok(m) => m.len(),
-                Err(_) => return false,
+                Err(_) => return OffsiteCheck::NotConfirmed,
             };
             let fname = file
                 .file_name()
@@ -7068,8 +7288,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                     .is_some();
                 // Existence-only verification of an age object is worthless if
                 // the upload that produced it may have been truncated — so an
-                // age target only counts when this run's push to it fully
-                // succeeded (age exited 0 ⇒ the complete ciphertext streamed).
+                // age target only counts with a complete push on record.
                 // Unencrypted needs no such gate: `n == local` below catches a
                 // short copy on its own.
                 if age && !s3_push_ok.contains(&row.name) {
@@ -7080,14 +7299,20 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 } else {
                     format!("{prefix}{fname}")
                 };
+                asked += 1;
                 if let Ok(remote) = hyperion_adapters::backup::s3_object_size(&key, &target).await {
+                    answered += 1;
                     if hyperion_adapters::backup::s3_offsite_confirmed(remote, local_len, age) {
-                        return true;
+                        return OffsiteCheck::Confirmed;
                     }
                 }
             }
         }
-        false
+        if asked > 0 && answered == 0 {
+            OffsiteCheck::Unreachable
+        } else {
+            OffsiteCheck::NotConfirmed
+        }
     }
 
     /// Drop backup archives older than `retention.max_age_days` from disk
@@ -7153,8 +7378,22 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             if r.started_at >= cutoff {
                 continue;
             }
+            // A restore (or a push) is reading it right now: pruning it would
+            // pull the database dump out from under the restore. The next
+            // prune gets it.
+            if r.archive_path
+                .as_deref()
+                .is_some_and(|p| archive_in_use(std::path::Path::new(p)))
+            {
+                continue;
+            }
             if let Some(p) = r.archive_path.as_deref() {
                 let _ = tokio::fs::remove_file(p).await;
+                // The run's manifest sits beside its archive and was never
+                // removed with it, so every pruned backup left one behind.
+                if let Some(m) = manifest_path_for(std::path::Path::new(p)) {
+                    let _ = tokio::fs::remove_file(m).await;
+                }
             }
             if let Some(p) = r.db_dump_path.as_deref() {
                 let _ = tokio::fs::remove_file(p).await;
@@ -7186,7 +7425,26 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         let rows = hyperion_state::backups::list_for(&self.pool, &detail.id, limit.clamp(1, 500))
             .await
             .map_err(|e| RpcError::Internal_with(format!("list: {e}")))?;
-        Ok(rows.into_iter().map(run_to_wire).collect())
+        // Say, per row, why a local copy that is on record as off-site is
+        // still on disk. Read from THIS node's agent.toml — the node that owns
+        // the site and would do the dropping — not the master's, which is all
+        // the Settings page can show.
+        let policy = read_local_copy_policy(self.agent_config_path.as_deref());
+        let mut local_rank = 0usize;
+        Ok(rows
+            .into_iter()
+            .map(|r| {
+                let rank = is_local_copy(&r).then(|| {
+                    local_rank += 1;
+                    local_rank - 1
+                });
+                let (kind, note) = local_kept_reason(&r, policy, rank);
+                let mut w = run_to_wire(r);
+                w.local_kept = kind.to_string();
+                w.local_note = note;
+                w
+            })
+            .collect())
     }
 
     /// Install WordPress into an existing hosting.
@@ -11268,8 +11526,8 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             out.missing_locally = true;
             return out;
         };
-        // The row can outlive the file: retention prunes the archive and leaves
-        // the row. Nothing left to send — record it and move on.
+        // The row can name a file that is gone — removed by hand, or lost with
+        // a disk. Nothing left to send — record it and move on.
         if !tokio::fs::try_exists(&archive).await.unwrap_or(false) {
             let _ = hyperion_state::backups::set_remote(
                 &self.pool,
@@ -11287,6 +11545,9 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             return out;
         };
         let archive_path = std::path::PathBuf::from(&archive);
+        // Busy while it is being sent, so a sweep elsewhere does not drop it
+        // mid-upload. This method's own drop below goes straight to the gate.
+        let _busy = ArchiveInUse::claim(&archive_path);
         // Only offer the dump to a push (and to the drop gate) if it still
         // exists — a run may have been made before dumps were kept, or the
         // dump pruned separately.
@@ -11321,22 +11582,10 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                         )
                         .await;
                     } else {
-                        // Tri-state, same words as a fresh backup: `Some(false)`
-                        // means we LOOKED and it is not there.
-                        let (state, note) = match hyperion_adapters::backup::verify_remote(
-                            &archive_path,
-                            &up,
-                        )
-                        .await
-                        {
-                            Ok(Some(true)) => ("verified", String::new()),
-                            Ok(Some(false)) => (
-                                "failed",
-                                "uploaded, but the remote copy is missing or the wrong size"
-                                    .to_string(),
-                            ),
-                            Ok(None) | Err(_) => ("ok", String::new()),
-                        };
+                        // Tri-state, same words as a fresh backup: `failed`
+                        // means we LOOKED and a file is not there.
+                        let (state, note) =
+                            ftp_verify_run(&archive_path, dump_path.as_deref(), &up).await;
                         let _ = hyperion_state::backups::set_remote(
                             &self.pool, run.id, &url, state, &note,
                         )
@@ -11386,6 +11635,28 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             if !s3_push_ok.is_empty() {
                 landed = true;
             }
+            // Keep the run's record of complete S3 pushes true: a target
+            // pushed in full now is added, and one that was pushed to now and
+            // did NOT complete is removed — its object may have just been
+            // overwritten with a truncated one, and for an age target this
+            // record is all that stands between "the object exists" and "the
+            // whole ciphertext exists".
+            let attempted: std::collections::HashSet<&str> =
+                s3_pushed_targets.iter().map(|t| t.name.as_str()).collect();
+            let mut on_record: std::collections::HashSet<String> = run
+                .s3_ok_targets
+                .iter()
+                .filter(|n| !attempted.contains(n.as_str()))
+                .cloned()
+                .collect();
+            on_record.extend(s3_push_ok.iter().cloned());
+            let mut names: Vec<String> = on_record.into_iter().collect();
+            names.sort();
+            if names != run.s3_ok_targets {
+                let _ =
+                    hyperion_state::backups::set_s3_ok_targets(&self.pool, run.id, &names).await;
+            }
+            s3_push_ok = names.into_iter().collect();
         }
 
         if landed {
@@ -11397,21 +11668,28 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         // The drop only ever runs on a push that landed somewhere, and even
         // then the gate independently re-verifies before it removes anything.
         if drop_local && landed {
+            let mut files: Vec<(&str, &std::path::Path)> =
+                vec![("archive", archive_path.as_path())];
+            if let Some(d) = dump_path.as_deref() {
+                files.push(("database dump", d));
+            }
             match self
                 .maybe_drop_local_after_offsite(
                     &detail,
                     run.id,
                     &archive_path,
-                    dump_path.as_deref(),
+                    &files,
                     &s3_pushed_targets,
                     &s3_push_ok,
+                    Some(&run.local_note),
                 )
                 .await
             {
                 DropLocalOutcome::Dropped => out.dropped = true,
-                DropLocalOutcome::Kept | DropLocalOutcome::NoDestination => out.kept_local = true,
+                _ => out.kept_local = true,
             }
         }
+        out.s3_push_ok = s3_push_ok;
         out
     }
 
@@ -11439,13 +11717,65 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             .await
             .map_err(|e| RpcError::Internal_with(format!("backfill list: {e}")))?;
         out.considered = runs.len() as i64;
+        // Push first, drop after: the drop is applied per site below, under the
+        // node's "keep the newest N local copies" rule, so a sweep never drops
+        // a copy the node is set to keep. What each push proved is carried
+        // over as evidence (an age-encrypted target can only confirm a copy
+        // this process just pushed in full).
+        let mut evidence: std::collections::HashMap<i64, std::collections::HashSet<String>> =
+            std::collections::HashMap::new();
+        let mut sites: Vec<HostingId> = Vec::new();
         for run in runs {
-            let o = self.push_run_offsite(&run, &s3_targets, drop_local).await;
+            let o = self.push_run_offsite(&run, &s3_targets, false).await;
             out.pushed += o.pushed as i64;
             out.failed += o.failed as i64;
             out.missing_locally += o.missing_locally as i64;
-            out.dropped += o.dropped as i64;
-            out.kept_local += o.kept_local as i64;
+            if o.pushed {
+                evidence.insert(run.id, o.s3_push_ok);
+                if !sites.contains(&run.hosting_id) {
+                    sites.push(run.hosting_id.clone());
+                }
+            }
+        }
+        if drop_local {
+            // Also every site still holding a local copy of a backup that was
+            // ALREADY off-site — those were never "needing off-site", so the
+            // push above never saw them, and they are exactly the copies an
+            // operator who just switched dropping on is looking at.
+            match hyperion_state::backups::hostings_with_offsite_local_copies(&self.pool).await {
+                Ok(more) => {
+                    for h in more {
+                        if !sites.contains(&h) {
+                            sites.push(h);
+                        }
+                    }
+                }
+                Err(e) => tracing::warn!(error = %e,
+                    "backfill: could not list sites with off-site copies still on disk"),
+            }
+            let keep = read_local_copy_policy(self.agent_config_path.as_deref()).keep_latest;
+            let targets: Vec<&hyperion_types::S3BackupTarget> = s3_targets.iter().collect();
+            for h in sites {
+                let Ok(detail) = self.get(HostingSelector::Id(h)).await else {
+                    continue;
+                };
+                for (id, o) in self
+                    .enforce_local_copies(&detail, keep, &targets, &evidence)
+                    .await
+                {
+                    match o {
+                        DropLocalOutcome::Dropped => {
+                            out.dropped += 1;
+                            if !evidence.contains_key(&id) {
+                                out.already_offsite += 1;
+                            }
+                        }
+                        DropLocalOutcome::MissingLocally => out.missing_locally += 1,
+                        o if o.kept() => out.kept_local += 1,
+                        _ => {}
+                    }
+                }
+            }
         }
         self.append_audit(
             "backup.offsite_backfill",
@@ -11457,6 +11787,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 "missing_locally": out.missing_locally,
                 "dropped": out.dropped,
                 "kept_local": out.kept_local,
+                "already_offsite": out.already_offsite,
                 "drop_local": drop_local,
             })
             .to_string(),
@@ -11514,6 +11845,39 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 continue;
             }
             out.considered += 1;
+            // Already off-site on record? Re-check it where it is and drop the
+            // local copy without sending it again — the gate verifies each
+            // file independently, so this is exactly as safe as dropping
+            // after a fresh push, and a 300 MiB archive that is already on
+            // the FTP does not cross the wire twice. Silent on refusal: the
+            // push below is the fallback and reports for itself.
+            if drop_local && run.offsite_on_record() && run.archive_path.is_some() {
+                let targets: Vec<&hyperion_types::S3BackupTarget> = s3_targets.iter().collect();
+                let evidence: std::collections::HashSet<String> =
+                    run.s3_ok_targets.iter().cloned().collect();
+                match self
+                    .drop_run_local_if_offsite(&detail, &run, &targets, &evidence, None)
+                    .await
+                {
+                    DropLocalOutcome::Dropped => {
+                        out.dropped += 1;
+                        out.already_offsite += 1;
+                        continue;
+                    }
+                    // Already off-site and no longer on disk: the row was set
+                    // straight; there is nothing to send or drop.
+                    DropLocalOutcome::MissingLocally => {
+                        out.missing_locally += 1;
+                        continue;
+                    }
+                    // A restore or push is using it right now — try later.
+                    DropLocalOutcome::Busy => {
+                        out.kept_local += 1;
+                        continue;
+                    }
+                    _ => {}
+                }
+            }
             let o = self.push_run_offsite(&run, &s3_targets, drop_local).await;
             out.pushed += o.pushed as i64;
             out.failed += o.failed as i64;
@@ -11532,6 +11896,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 "missing_locally": out.missing_locally,
                 "dropped": out.dropped,
                 "kept_local": out.kept_local,
+                "already_offsite": out.already_offsite,
                 "drop_local": drop_local,
             })
             .to_string(),
@@ -24995,8 +25360,12 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             slack: slack_view,
             backup_remote: backup_remote_view,
             backup_retention: backup_retention_view,
-            backup: hyperion_types::BackupConfigView {
-                drop_local_after_offsite: read_backup_drop_local(self.agent_config_path.as_deref()),
+            backup: {
+                let p = read_local_copy_policy(self.agent_config_path.as_deref());
+                hyperion_types::BackupConfigView {
+                    drop_local_after_offsite: p.drop,
+                    keep_local_latest: p.keep_latest as i64,
+                }
             },
             cluster: cluster_view,
             notifications: read_notifications_section(self.agent_config_path.as_deref()),
@@ -28768,6 +29137,23 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 ),
             });
         }
+        // The archive (and its dump beside it) is in use until this returns:
+        // the drop-local sweep and the retention prune leave it alone.
+        let _busy = ArchiveInUse::claim(&canonical);
+        // Where the dump is, and whether it is there NOW — before minutes of
+        // extraction. A dump that was here at the start and is gone by the
+        // database step is a restore that would put back the files of one
+        // moment over the database of another and call it done; that has to
+        // fail loudly, whatever removed it.
+        let sibling_dump = canonical.file_stem().and_then(|s| s.to_str()).map(|stem| {
+            // strip the trailing ".tar" if present from .tar.gz double-ext
+            let trim = stem.strip_suffix(".tar").unwrap_or(stem);
+            canonical
+                .parent()
+                .unwrap_or(std::path::Path::new("/"))
+                .join(format!("{trim}.sql"))
+        });
+        let dump_at_start = sibling_dump.as_deref().is_some_and(|p| p.exists());
 
         // 1. Extract tar.gz over the hosting root (unless db-only).
         let host_root = std::path::PathBuf::from(&self.paths.home_root)
@@ -28803,12 +29189,18 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         //    (unless files-only). For db-only restores a missing dump is
         //    an error — the operator explicitly asked to put a DB back.
         if mode.restores_db() {
-            let archive_dir = canonical.parent().unwrap_or(std::path::Path::new("/"));
             let mut dump_found = false;
-            if let Some(stem) = canonical.file_stem().and_then(|s| s.to_str()) {
-                // strip the trailing ".tar" if present from .tar.gz double-ext
-                let trim = stem.strip_suffix(".tar").unwrap_or(stem);
-                let sibling = archive_dir.join(format!("{trim}.sql"));
+            if let Some(sibling) = sibling_dump.as_ref() {
+                if !sibling.exists() && dump_at_start && detail.database.is_some() {
+                    return Err(RpcError::ProvisioningFailed {
+                        stage: "db_restore".into(),
+                        reason: "the backup's database dump disappeared while the files were \
+                                 being restored — the files were put back, the database was \
+                                 NOT; restore the database again from this backup's off-site \
+                                 copy"
+                            .into(),
+                    });
+                }
                 if sibling.exists() {
                     dump_found = true;
                     if let Some(db) = &detail.database {
@@ -28816,14 +29208,14 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                             hyperion_types::DbProvision::MariaDB => {
                                 hyperion_adapters::backup::restore_mariadb_dump(
                                     &db.db_name,
-                                    &sibling,
+                                    sibling,
                                 )
                                 .await
                             }
                             hyperion_types::DbProvision::Postgres => {
                                 hyperion_adapters::backup::restore_postgres_dump(
                                     &db.db_name,
-                                    &sibling,
+                                    sibling,
                                 )
                                 .await
                             }
@@ -34687,21 +35079,52 @@ pub(crate) fn read_backup_retention_section(
     }
 }
 
-/// `[backup] drop_local_after_offsite` as it is ON DISK, defaulting to false.
+/// The `[backup]` local-copy policy: drop local copies once they are verified
+/// off-site, and how many of each site's newest local copies to keep anyway.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub(crate) struct LocalCopyPolicy {
+    /// `drop_local_after_offsite`.
+    pub drop: bool,
+    /// `keep_local_latest` — 0 drops every local copy that is verified
+    /// off-site, which is what the option meant before this knob existed.
+    pub keep_latest: usize,
+}
+
+/// `[backup]` as it is ON DISK, defaulting to "keep every local copy".
 ///
-/// Read fresh at the moment a backup finishes, NOT from agent boot state —
-/// same reasoning as retention: the panel saves this on every node, and a
-/// worker running the value it booted with would ignore the save until it
-/// restarted. Missing section/key/file all mean "keep the local copy", which
-/// is the fail-safe direction: an unreadable agent.toml must never start
-/// deleting local backups nobody asked it to.
-pub(crate) fn read_backup_drop_local(cfg_path: Option<&std::path::Path>) -> bool {
-    read_agent_doc(cfg_path)
-        .as_ref()
-        .and_then(|doc| doc.get("backup"))
-        .and_then(|sec| sec.get("drop_local_after_offsite"))
+/// Read fresh whenever it is acted on, NOT from agent boot state — same
+/// reasoning as retention: the panel saves this on every node, and a worker
+/// running the value it booted with would ignore the save until it restarted.
+/// Missing section/key/file all mean "keep the local copy", which is the
+/// fail-safe direction: an unreadable agent.toml must never start deleting
+/// local backups nobody asked it to. An unreadable keep count turns dropping
+/// off (see below); one above 1000 is clamped down, which keeps more.
+pub(crate) fn read_local_copy_policy(cfg_path: Option<&std::path::Path>) -> LocalCopyPolicy {
+    let doc = read_agent_doc(cfg_path);
+    let sec = doc.as_ref().and_then(|d| d.get("backup"));
+    let drop = sec
+        .and_then(|s| s.get("drop_local_after_offsite"))
         .and_then(|v| v.as_bool())
-        .unwrap_or(false)
+        .unwrap_or(false);
+    // Missing = 0. Present but not a whole number >= 0 (a quoted "3", 3.0, a
+    // negative) is NOT read as 0: 0 is the most aggressive setting, and a
+    // typo must not delete the copies its author meant to keep. Dropping is
+    // off until the file says something readable.
+    let keep_latest = match sec.and_then(|s| s.get("keep_local_latest")) {
+        None => 0,
+        Some(v) => match v.as_integer() {
+            Some(n) if n >= 0 => n.min(1000) as usize,
+            _ => {
+                if drop {
+                    tracing::warn!(value = %v.to_string().trim(),
+                        "[backup] keep_local_latest is not a whole number >= 0 — \
+                         not dropping any local backup copy until it is fixed");
+                }
+                return LocalCopyPolicy::default();
+            }
+        },
+    };
+    LocalCopyPolicy { drop, keep_latest }
 }
 
 /// Parse agent.toml once, for the readers above.
@@ -34886,6 +35309,15 @@ fn parse_agent_section_fields(
             ("backup", "drop_local_after_offsite") => {
                 crate::config_persist::FieldValue::Bool(parse_bool(v)?)
             }
+            // How many of each site's newest local copies stay on disk even
+            // with dropping on. 0 = drop every copy that is verified off-site.
+            ("backup", "keep_local_latest") => {
+                let n = parse_int(v)?;
+                if !(0..=1000).contains(&n) {
+                    return Err(bad(format!("keep_local_latest must be 0..=1000, got {n}")));
+                }
+                crate::config_persist::FieldValue::Int(n)
+            }
             // [snapshots] retention. keep_days = 0 means "never by age".
             ("snapshots", "keep_days") => {
                 let n = parse_int(v)?;
@@ -35154,6 +35586,10 @@ fn run_to_wire(r: hyperion_state::backups::BackupRun) -> hyperion_types::BackupR
         remote_state: r.remote_state,
         remote_error: r.remote_error,
         no_offsite: r.no_offsite,
+        // Derived per node policy by `backup_list`, not stored as-is.
+        local_kept: String::new(),
+        local_note: String::new(),
+        s3_ok_targets: r.s3_ok_targets,
         id: r.id,
         hosting_id: r.hosting_id,
         target: r.target,
@@ -35946,7 +36382,7 @@ const OFFSITE_WORKER_HAS_NO_TARGETS: &str =
     "no off-site target reached this scheduled run: the cluster's off-site targets live in the \
      master's table and a worker keeps none of its own, so this backup exists only on this node. \
      Until that is fixed, run the backup from the panel (which sends the targets with the \
-     request) or give this node its own copy via [remote_backup] in its agent.toml";
+     request) or give this node its own copy via [backup_remote] in its agent.toml";
 
 /// Which of the resolved off-site targets one hosting's backup may use.
 /// Borrows the caller's slice — nothing is copied until an upload happens.
@@ -36013,6 +36449,167 @@ fn may_drop_local_after_offsite(used_offsite: bool, files_confirmed: &[bool]) ->
     used_offsite && !files_confirmed.is_empty() && files_confirmed.iter().all(|&c| c)
 }
 
+/// Is this run a LOCAL copy the drop-local policy counts: a finished, good
+/// backup whose archive is still on this node, and not a rollback snapshot
+/// (those are local-only by design and outside the policy altogether).
+fn is_local_copy(r: &hyperion_state::backups::BackupRun) -> bool {
+    r.state == "ok" && r.archive_path.is_some() && !r.no_offsite
+}
+
+/// Which runs' local copies the drop-local option should now TRY to drop for
+/// one site, given its rows NEWEST FIRST. Pure, so the selection is tested on
+/// its own; the drop gate still re-verifies every one before deleting.
+///
+///   * Only local copies count (`is_local_copy`), and the newest
+///     `keep_latest` of them stay, whatever their off-site state — the
+///     operator asked for that many fast restores on the box.
+///   * Past those, a run qualifies only with evidence that it went off-site:
+///     its row records it (FTP `ok`/`verified`, or a completed S3 push), or the
+///     caller pushed it moments ago (`just_pushed`). A run with no such evidence is not asked about at all —
+///     the answer would be "no" after every backup, and an operator who wants
+///     those copied off-site has the backfill for it.
+fn local_copies_to_drop(
+    rows: &[hyperion_state::backups::BackupRun],
+    keep_latest: usize,
+    just_pushed: &std::collections::HashSet<i64>,
+) -> Vec<i64> {
+    rows.iter()
+        .filter(|r| is_local_copy(r))
+        .skip(keep_latest)
+        .filter(|r| just_pushed.contains(&r.id) || r.offsite_on_record())
+        .map(|r| r.id)
+        .collect()
+}
+
+/// Why a run's local copy is still on disk, as `(kind, words)` for the
+/// Backups card — see `BackupRunWire::local_kept` for the kinds. `rank` is the
+/// run's position among the site's local copies, newest first (`None` when it
+/// is not one). Derived from the node's CURRENT policy each time the list is
+/// read, so it can never go stale; only the "could not confirm" reason is
+/// stored, because only the drop step knows it.
+fn local_kept_reason(
+    r: &hyperion_state::backups::BackupRun,
+    policy: LocalCopyPolicy,
+    rank: Option<usize>,
+) -> (&'static str, String) {
+    if !is_local_copy(r) {
+        return ("", String::new());
+    }
+    // A drop step that actually ran and refused is the most specific answer
+    // there is — including an on-demand "Off-site & drop" on a node where the
+    // automatic option is off, or on one of the newest copies. The note is
+    // cleared with the local paths, so it exists only while the copy does.
+    if !r.local_note.is_empty() {
+        return ("unconfirmed", r.local_note.clone());
+    }
+    let on_record = r.offsite_on_record();
+    if !policy.drop {
+        return if on_record {
+            (
+                "setting_off",
+                "Kept on this node: \"Delete the local copy once it is verified off-site\" is \
+                 off for this node (Settings → Backups & trash → Local backup copies)."
+                    .to_string(),
+            )
+        } else {
+            ("", String::new())
+        };
+    }
+    if on_record && rank.is_some_and(|k| k < policy.keep_latest) {
+        return (
+            "keep_newest",
+            format!(
+                "Kept on this node: one of the {} newest local copies it is set to keep \
+                 (Settings → Backups & trash → Local backup copies).",
+                policy.keep_latest
+            ),
+        );
+    }
+    if on_record {
+        return (
+            "pending",
+            "Dropped after this site's next archive backup (scheduled, or Back up now), once \
+             it is re-checked off-site — or now, with \"Off-site & drop\"."
+                .to_string(),
+        );
+    }
+    ("", String::new())
+}
+
+/// The reason the drop step stores on a run whose copy it kept, naming the
+/// files it could not confirm off-site. Stable wording on purpose: the audit
+/// row is written only when this text changes, so a copy that stays
+/// unconfirmed is not re-reported after every backup.
+fn local_kept_unconfirmed_note(unconfirmed: &[&str]) -> String {
+    let what = match unconfirmed {
+        [] => "the off-site copy".to_string(),
+        [one] => format!("the off-site copy of the {one}"),
+        many => format!("the off-site copy of the {}", many.join(" and the ")),
+    };
+    format!(
+        "Kept on this node: {what} could not be confirmed (missing, the wrong size, or the \
+         target could not be reached to check)."
+    )
+}
+
+/// The `.manifest.json` written beside a backup archive:
+/// `<domain>-<ts>.tar.gz` → `<domain>-<ts>.manifest.json`, same directory.
+/// `None` for a path that is not a `.tar.gz` — never guess at a sibling.
+fn manifest_path_for(archive: &std::path::Path) -> Option<std::path::PathBuf> {
+    let name = archive.file_name()?.to_str()?;
+    let stem = name.strip_suffix(".tar.gz")?;
+    if stem.is_empty() {
+        return None;
+    }
+    Some(archive.with_file_name(format!("{stem}.manifest.json")))
+}
+
+/// What an FTP push can honestly claim, from the size re-check of each file it
+/// sent: `(label, Some(true))` = listed back at the right size,
+/// `Some(false)` = we LOOKED and it is missing or the wrong size, `None` = we
+/// could not look (no size given, or unreachable).
+///
+/// `verified` only when EVERY file checked out — the dump is half the backup,
+/// and the drop step demands both before it deletes anything, so "off-site ✓"
+/// must not promise less. Any contradiction is `failed`, naming the file.
+/// Otherwise `ok`: the upload returned success, and nothing proved otherwise.
+fn ftp_offsite_verdict(checks: &[(&str, Option<bool>)]) -> (&'static str, String) {
+    if let Some((what, _)) = checks.iter().find(|(_, c)| *c == Some(false)) {
+        return (
+            "failed",
+            format!("uploaded, but the remote {what} is missing or the wrong size"),
+        );
+    }
+    if !checks.is_empty() && checks.iter().all(|(_, c)| *c == Some(true)) {
+        return ("verified", String::new());
+    }
+    ("ok", String::new())
+}
+
+/// Re-check a just-uploaded archive (and its dump, when there is one) on the
+/// FTP target and turn the answers into the run's remote state.
+async fn ftp_verify_run(
+    archive: &std::path::Path,
+    dump: Option<&std::path::Path>,
+    up: &hyperion_adapters::backup::RemoteUpload<'_>,
+) -> (&'static str, String) {
+    let mut checks: Vec<(&str, Option<bool>)> = Vec::with_capacity(2);
+    for (label, file) in
+        std::iter::once(("archive", archive)).chain(dump.map(|d| ("database dump", d)))
+    {
+        let seen = match hyperion_adapters::backup::verify_remote(file, up).await {
+            Ok(v) => v,
+            Err(e) => {
+                tracing::warn!(file = %file.display(), error = %e,
+                    "remote backup: could not verify the uploaded copy");
+                None
+            }
+        };
+        checks.push((label, seen));
+    }
+    ftp_offsite_verdict(&checks)
+}
+
 /// What `maybe_drop_local_after_offsite` actually did — so an on-demand caller
 /// can report "removed" vs "kept" instead of guessing from a fire-and-forget.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -36025,19 +36622,118 @@ enum DropLocalOutcome {
     /// No off-site destination was used, so there was nothing to fall back on
     /// and the local copy was left in place.
     NoDestination,
+    /// KEPT because no destination answered at all (unreachable, timed out) —
+    /// a sweep stops here instead of asking the same host about every older
+    /// copy and waiting out every timeout.
+    Unreachable,
+    /// The archive is already gone from disk (and its dump too): nothing was
+    /// deleted, the row was set straight. Not a "kept" copy.
+    MissingLocally,
+    /// Left alone because some operation on this node is using the archive
+    /// right now (a restore reading it, a backup or push still sending it).
+    Busy,
+}
+
+impl DropLocalOutcome {
+    /// Did a local copy stay on disk although it was asked to go? What the
+    /// job counts as `kept_local`.
+    fn kept(self) -> bool {
+        matches!(self, Self::Kept | Self::Unreachable | Self::Busy)
+    }
+}
+
+/// One file's answer from the off-site re-check (see `file_is_offsite`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum OffsiteCheck {
+    /// Present off-site at the right size (or, for an age target with a
+    /// complete push on record, present at all).
+    Confirmed,
+    /// A destination answered, and it was not a confirmation — or none could
+    /// be asked.
+    NotConfirmed,
+    /// Every destination asked failed to answer.
+    Unreachable,
+}
+
+/// Backup archives some operation on THIS node is using right now — a
+/// restore reading one, a backup writing and pushing its own, an on-demand
+/// push sending one — counted, because two operations can hold the same file.
+/// The drop-local sweep and the retention prune leave a busy archive alone:
+/// deleting it under a restore lets `tar` finish from its open handle and then
+/// finds the database dump gone, so the restore "succeeds" with the files of
+/// one moment and the database of another. In-process is enough: only the
+/// agent that owns the files ever deletes them.
+fn archives_in_use() -> &'static std::sync::Mutex<HashMap<std::path::PathBuf, usize>> {
+    static IN_USE: std::sync::OnceLock<std::sync::Mutex<HashMap<std::path::PathBuf, usize>>> =
+        std::sync::OnceLock::new();
+    IN_USE.get_or_init(|| std::sync::Mutex::new(HashMap::new()))
+}
+
+/// The registry key for an archive path: its directory canonicalized plus its
+/// file name, so a key taken before the file exists (a backup about to write
+/// it) matches one taken after, and a restore's canonical path matches the
+/// row's spelling of it.
+fn archive_use_key(p: &std::path::Path) -> std::path::PathBuf {
+    match (p.parent(), p.file_name()) {
+        (Some(dir), Some(name)) => std::fs::canonicalize(dir)
+            .unwrap_or_else(|_| dir.to_path_buf())
+            .join(name),
+        _ => p.to_path_buf(),
+    }
+}
+
+/// Is some operation on this node using this archive right now?
+fn archive_in_use(p: &std::path::Path) -> bool {
+    let key = archive_use_key(p);
+    archives_in_use()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(&key)
+        .is_some_and(|n| *n > 0)
+}
+
+/// Holds an archive as in use until dropped — on every exit path, so an early
+/// return or an error can never leave a file protected forever.
+struct ArchiveInUse(std::path::PathBuf);
+
+impl ArchiveInUse {
+    fn claim(p: &std::path::Path) -> Self {
+        let key = archive_use_key(p);
+        *archives_in_use()
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .entry(key.clone())
+            .or_insert(0) += 1;
+        ArchiveInUse(key)
+    }
+}
+
+impl Drop for ArchiveInUse {
+    fn drop(&mut self) {
+        let mut map = archives_in_use().lock().unwrap_or_else(|e| e.into_inner());
+        if let Some(n) = map.get_mut(&self.0) {
+            *n = n.saturating_sub(1);
+            if *n == 0 {
+                map.remove(&self.0);
+            }
+        }
+    }
 }
 
 /// Per-run result of `push_run_offsite`, folded into an `OffsiteBackfillResult`
 /// by both the estate-wide backfill and the per-hosting push-drop. Exactly one
 /// of `pushed`/`failed`/`missing_locally` is set, plus at most one of
 /// `dropped`/`kept_local` when a drop was requested.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
 struct RunOffsiteOutcome {
     pushed: bool,
     failed: bool,
     missing_locally: bool,
     dropped: bool,
     kept_local: bool,
+    /// The S3 targets this push FULLY succeeded to — evidence a later drop
+    /// step needs for age-encrypted targets (see `file_is_offsite`).
+    s3_push_ok: std::collections::HashSet<String>,
 }
 
 /// Canonicalise a backup cadence string to one of the four known values; any
@@ -37949,6 +38645,307 @@ mod tests {
         assert!(!may_drop_local_after_offsite(true, &[]));
     }
 
+    fn bk_run(
+        id: i64,
+        state: &str,
+        local: bool,
+        remote_state: &str,
+        no_offsite: bool,
+    ) -> hyperion_state::backups::BackupRun {
+        hyperion_state::backups::BackupRun {
+            id,
+            hosting_id: hyperion_types::HostingId("h".into()),
+            target: "local".into(),
+            started_at: 1000 - id,
+            finished_at: Some(1000 - id),
+            state: state.into(),
+            archive_path: local.then(|| format!("/b/x.cz-{id}.tar.gz")),
+            db_dump_path: None,
+            bytes_total: 1,
+            error_message: None,
+            sha256_hex: String::new(),
+            remote_blob_key: String::new(),
+            remote_state: remote_state.into(),
+            remote_error: String::new(),
+            no_offsite,
+            local_note: String::new(),
+            s3_ok_targets: Vec::new(),
+        }
+    }
+
+    /// WHICH local copies the drop-local policy goes after. The gate still
+    /// re-verifies each one, but a row this picks that it should not is one
+    /// re-verify away from being deleted — so every exclusion is pinned.
+    #[test]
+    fn local_copies_to_drop_keeps_the_newest_and_needs_offsite_evidence() {
+        use super::local_copies_to_drop;
+        use std::collections::HashSet;
+        // Newest first, as `list_for` returns them.
+        let rows = vec![
+            bk_run(1, "ok", true, "verified", false),  // newest
+            bk_run(2, "running", true, "", false),     // not finished → never
+            bk_run(3, "ok", true, "", false),          // local, no off-site evidence
+            bk_run(4, "ok", true, "ok", false),        // uploaded
+            bk_run(5, "ok", false, "verified", false), // local copy already gone
+            bk_run(6, "ok", true, "verified", true),   // rollback snapshot → never
+            bk_run(7, "failed", true, "", false),      // failed → never
+            bk_run(8, "ok", true, "failed", false),    // off-site failed
+        ];
+        let none = HashSet::new();
+        // keep 0: everything with evidence that is a real local copy.
+        assert_eq!(local_copies_to_drop(&rows, 0, &none), vec![1, 4]);
+        // keep 1: the newest LOCAL copy (1) stays.
+        assert_eq!(local_copies_to_drop(&rows, 1, &none), vec![4]);
+        // keep 2: 1 and 3 are the two newest local copies — 3 counts towards
+        // the kept ones even though it has no off-site copy.
+        assert_eq!(local_copies_to_drop(&rows, 2, &none), vec![4]);
+        assert_eq!(local_copies_to_drop(&rows, 3, &none), Vec::<i64>::new());
+        // A run pushed moments ago is a candidate before its row says so (an
+        // S3 push writes no remote state) — but never past the keep rule, and
+        // never when it is a snapshot or has no local copy.
+        let pushed: HashSet<i64> = [3, 8, 6, 5].into_iter().collect();
+        assert_eq!(local_copies_to_drop(&rows, 0, &pushed), vec![1, 3, 4, 8]);
+        assert_eq!(local_copies_to_drop(&rows, 2, &pushed), vec![4, 8]);
+        // A completed S3 push on record is evidence on its own (the S3 push
+        // writes no remote_state) — so an S3-only node's older copies are
+        // still found once they leave the keep window.
+        let mut rows = rows;
+        rows[2].s3_ok_targets = vec!["vault".into()]; // run 3
+        assert_eq!(local_copies_to_drop(&rows, 0, &none), vec![1, 3, 4]);
+        assert_eq!(local_copies_to_drop(&rows, 1, &none), vec![3, 4]);
+    }
+
+    /// The busy-archive registry counts: two holders of one archive keep it
+    /// busy until BOTH let go, and a key taken before the file exists matches
+    /// the path spelled the same way afterwards.
+    #[test]
+    fn archive_in_use_registry_counts_holders() {
+        use super::{archive_in_use, ArchiveInUse};
+        let dir = tempfile::tempdir().expect("dir");
+        let p = dir.path().join("x.cz-1.tar.gz");
+        assert!(!archive_in_use(&p));
+        let a = ArchiveInUse::claim(&p);
+        std::fs::write(&p, b"x").expect("w");
+        assert!(
+            archive_in_use(&p),
+            "claimed before it existed, still matches"
+        );
+        let b = ArchiveInUse::claim(&p.canonicalize().expect("canon"));
+        drop(a);
+        assert!(archive_in_use(&p), "the second holder still has it");
+        drop(b);
+        assert!(!archive_in_use(&p));
+    }
+
+    /// The Backups card's "why is the local copy still here" — derived from
+    /// the node's CURRENT policy, so it can never go stale.
+    #[test]
+    fn local_kept_reason_explains_every_kept_copy() {
+        use super::{local_kept_reason, LocalCopyPolicy};
+        let off = LocalCopyPolicy {
+            drop: false,
+            keep_latest: 0,
+        };
+        let on = LocalCopyPolicy {
+            drop: true,
+            keep_latest: 0,
+        };
+        let on_keep2 = LocalCopyPolicy {
+            drop: true,
+            keep_latest: 2,
+        };
+        let verified = bk_run(1, "ok", true, "verified", false);
+        let uploaded = bk_run(1, "ok", true, "ok", false);
+        let local_only = bk_run(1, "ok", true, "", false);
+
+        // Option off: only an off-site copy has something to explain.
+        assert_eq!(local_kept_reason(&verified, off, Some(0)).0, "setting_off");
+        assert_eq!(local_kept_reason(&uploaded, off, Some(0)).0, "setting_off");
+        assert_eq!(local_kept_reason(&local_only, off, Some(0)).0, "");
+        // Not a local copy at all → nothing, whatever the policy.
+        for r in [
+            bk_run(1, "ok", false, "verified", false),
+            bk_run(1, "ok", true, "verified", true),
+            bk_run(1, "running", true, "verified", false),
+        ] {
+            assert_eq!(local_kept_reason(&r, off, Some(0)).0, "");
+            assert_eq!(local_kept_reason(&r, on, Some(0)).0, "");
+        }
+        // Option on, within the newest N → kept on purpose.
+        let (k, words) = local_kept_reason(&verified, on_keep2, Some(1));
+        assert_eq!(k, "keep_newest");
+        assert!(words.contains('2'), "names the count: {words}");
+        // Past N, nothing stored yet → it goes at the next backup.
+        assert_eq!(local_kept_reason(&verified, on_keep2, Some(2)).0, "pending");
+        assert_eq!(local_kept_reason(&verified, on, Some(0)).0, "pending");
+        // The drop step refused it → its stored reason, verbatim.
+        let mut refused = verified.clone();
+        refused.local_note = "Kept on this node: nope".into();
+        assert_eq!(
+            local_kept_reason(&refused, on, Some(3)),
+            ("unconfirmed", "Kept on this node: nope".to_string())
+        );
+        // …whatever the policy says now: the note is the most specific answer
+        // (an on-demand drop runs with the option off, and ignores keep N).
+        assert_eq!(local_kept_reason(&refused, off, Some(0)).0, "unconfirmed");
+        assert_eq!(
+            local_kept_reason(&refused, on_keep2, Some(0)).0,
+            "unconfirmed"
+        );
+        // …even for a run whose own push failed (no off-site on record).
+        let mut refused_local = local_only.clone();
+        refused_local.local_note = "Kept on this node: nope".into();
+        assert_eq!(
+            local_kept_reason(&refused_local, on, Some(3)).0,
+            "unconfirmed"
+        );
+        assert_eq!(
+            local_kept_reason(&refused_local, off, Some(3)).0,
+            "unconfirmed"
+        );
+        assert_eq!(local_kept_reason(&local_only, on, Some(3)).0, "");
+        // An S3-only backup with a completed push is on record too.
+        let mut s3_only = local_only.clone();
+        s3_only.s3_ok_targets = vec!["vault".into()];
+        assert_eq!(local_kept_reason(&s3_only, off, Some(0)).0, "setting_off");
+        assert_eq!(local_kept_reason(&s3_only, on, Some(0)).0, "pending");
+    }
+
+    #[test]
+    fn local_kept_unconfirmed_note_names_the_files() {
+        use super::local_kept_unconfirmed_note;
+        assert!(local_kept_unconfirmed_note(&["archive"]).contains("copy of the archive could"));
+        assert!(local_kept_unconfirmed_note(&["archive", "database dump"])
+            .contains("copy of the archive and the database dump could"));
+        assert!(local_kept_unconfirmed_note(&[]).contains("the off-site copy could"));
+    }
+
+    #[test]
+    fn manifest_path_for_only_derives_a_real_sibling() {
+        use super::manifest_path_for;
+        use std::path::Path;
+        assert_eq!(
+            manifest_path_for(Path::new("/b/u/www.x.cz-1790627073.tar.gz")).as_deref(),
+            Some(Path::new("/b/u/www.x.cz-1790627073.manifest.json"))
+        );
+        // Never guess at anything that is not one of our archives.
+        assert_eq!(manifest_path_for(Path::new("/b/u/x.cz-1.sql")), None);
+        assert_eq!(manifest_path_for(Path::new("/b/u/.tar.gz")), None);
+        assert_eq!(manifest_path_for(Path::new("/")), None);
+    }
+
+    /// "off-site ✓" must mean every file checked out — the same thing the
+    /// drop step demands before it deletes.
+    #[test]
+    fn ftp_offsite_verdict_needs_every_file() {
+        use super::ftp_offsite_verdict;
+        assert_eq!(
+            ftp_offsite_verdict(&[("archive", Some(true))]).0,
+            "verified"
+        );
+        assert_eq!(
+            ftp_offsite_verdict(&[("archive", Some(true)), ("database dump", Some(true))]).0,
+            "verified"
+        );
+        // Could not look at the dump → only "uploaded", never ✓.
+        assert_eq!(
+            ftp_offsite_verdict(&[("archive", Some(true)), ("database dump", None)]).0,
+            "ok"
+        );
+        // We LOOKED and the dump is not right → failed, naming it.
+        let (st, note) =
+            ftp_offsite_verdict(&[("archive", Some(true)), ("database dump", Some(false))]);
+        assert_eq!(st, "failed");
+        assert!(note.contains("database dump"), "{note}");
+        let (st, note) = ftp_offsite_verdict(&[("archive", Some(false)), ("database dump", None)]);
+        assert_eq!(st, "failed");
+        assert!(note.contains("archive"), "{note}");
+        assert_eq!(ftp_offsite_verdict(&[("archive", None)]).0, "ok");
+        assert_eq!(ftp_offsite_verdict(&[]).0, "ok");
+    }
+
+    /// The policy as written by the Settings save (a real TOML bool + int) is
+    /// what a backup reads back; anything else is "keep every local copy".
+    #[test]
+    fn local_copy_policy_reads_back_what_settings_writes() {
+        use super::{read_local_copy_policy, LocalCopyPolicy};
+        let dir = tempfile::tempdir().expect("dir");
+        let cfg = dir.path().join("agent.toml");
+        // No file / no section → keep everything.
+        assert_eq!(read_local_copy_policy(None), LocalCopyPolicy::default());
+        assert_eq!(
+            read_local_copy_policy(Some(&cfg)),
+            LocalCopyPolicy::default()
+        );
+        std::fs::write(&cfg, "[agent]\n").expect("write");
+        assert_eq!(
+            read_local_copy_policy(Some(&cfg)),
+            LocalCopyPolicy::default()
+        );
+
+        // Through the same parser + writer the Settings form goes through.
+        let mut f = std::collections::BTreeMap::new();
+        f.insert("drop_local_after_offsite".to_string(), "true".to_string());
+        f.insert("keep_local_latest".to_string(), "2".to_string());
+        let parsed = super::parse_agent_section_fields("backup", &f).expect("valid");
+        let view: Vec<(&str, crate::config_persist::FieldValue)> = parsed
+            .iter()
+            .map(|(k, v)| (k.as_str(), v.clone()))
+            .collect();
+        crate::config_persist::set_many(&cfg, "backup", &view).expect("write");
+        assert_eq!(
+            read_local_copy_policy(Some(&cfg)),
+            LocalCopyPolicy {
+                drop: true,
+                keep_latest: 2
+            }
+        );
+
+        // Out of range is refused at the door…
+        let mut f = std::collections::BTreeMap::new();
+        f.insert("keep_local_latest".to_string(), "-1".to_string());
+        assert!(super::parse_agent_section_fields("backup", &f).is_err());
+        f.insert("keep_local_latest".to_string(), "1001".to_string());
+        assert!(super::parse_agent_section_fields("backup", &f).is_err());
+        // …and a hand-edited file: a quoted "true" is NOT a yes…
+        std::fs::write(
+            &cfg,
+            "[backup]\ndrop_local_after_offsite = \"true\"\nkeep_local_latest = -5\n",
+        )
+        .expect("write");
+        assert_eq!(
+            read_local_copy_policy(Some(&cfg)),
+            LocalCopyPolicy::default()
+        );
+        // …and a keep count that does not read as a whole number turns
+        // dropping OFF — never into "keep 0", the most aggressive setting.
+        for bad in ["\"3\"", "3.0", "-5", "true"] {
+            std::fs::write(
+                &cfg,
+                format!("[backup]\ndrop_local_after_offsite = true\nkeep_local_latest = {bad}\n"),
+            )
+            .expect("write");
+            assert_eq!(
+                read_local_copy_policy(Some(&cfg)),
+                LocalCopyPolicy::default(),
+                "keep_local_latest = {bad}"
+            );
+        }
+        // Too large is clamped down, which keeps more.
+        std::fs::write(
+            &cfg,
+            "[backup]\ndrop_local_after_offsite = true\nkeep_local_latest = 5000\n",
+        )
+        .expect("write");
+        assert_eq!(
+            read_local_copy_policy(Some(&cfg)),
+            LocalCopyPolicy {
+                drop: true,
+                keep_latest: 1000
+            }
+        );
+    }
+
     /// The net-rate math the realtime sampler runs each tick. Every branch here
     /// is one the adversarial review flagged as a false-spike source.
     #[test]
@@ -38015,6 +39012,258 @@ mod tests {
         assert!(matches!(err, RpcError::Validation { .. }), "got: {err:?}");
     }
 
+    /// The Backups card's reason comes from the OWNING node's policy: with the
+    /// option off (the default — no agent.toml here), an off-site copy that is
+    /// still local says so; a local-only or dropped one says nothing.
+    #[tokio::test]
+    async fn backup_list_says_why_an_offsite_copy_is_still_local() {
+        use hyperion_state::backups;
+        let pool = open_memory().await.expect("open");
+        let s = svc(pool.clone(), happy_mocks());
+        s.create(req("why.cz")).await.expect("create");
+        let sel = HostingSelector::Domain(Domain::parse("why.cz").unwrap());
+        let detail = s.get(sel.clone()).await.expect("get");
+
+        let mk = |at: i64, path: &'static str| {
+            let pool = pool.clone();
+            let id = detail.id.clone();
+            async move {
+                let r = backups::start(&pool, &id, "local", at)
+                    .await
+                    .expect("start");
+                backups::mark_ok(&pool, r, path, None, 10, at + 1)
+                    .await
+                    .expect("ok");
+                r
+            }
+        };
+        let verified = mk(300, "/b/why.cz-300.tar.gz").await;
+        backups::set_remote(&pool, verified, "ftp://v/why.cz-300.tar.gz", "verified", "")
+            .await
+            .expect("remote");
+        let local_only = mk(200, "/b/why.cz-200.tar.gz").await;
+        let dropped = mk(100, "/b/why.cz-100.tar.gz").await;
+        backups::set_remote(&pool, dropped, "ftp://v/why.cz-100.tar.gz", "verified", "")
+            .await
+            .expect("remote2");
+        backups::clear_local_paths(&pool, dropped)
+            .await
+            .expect("clear");
+
+        let list = s.backup_list(sel, 10).await.expect("list");
+        let by = |id: i64| list.iter().find(|b| b.id == id).expect("row");
+        assert_eq!(by(verified).local_kept, "setting_off");
+        assert!(!by(verified).local_note.is_empty());
+        assert_eq!(by(local_only).local_kept, "");
+        assert_eq!(by(dropped).local_kept, "");
+    }
+
+    /// The drop step with a destination it cannot reach: the local copy is
+    /// KEPT (never deleted on "could not look"), the row says why, and the
+    /// audit row is written once — not again after every later backup that
+    /// re-asks the same question and gets the same answer.
+    #[tokio::test]
+    async fn drop_local_keeps_an_unconfirmed_copy_and_reports_it_once() {
+        use hyperion_state::backups;
+        let pool = open_memory().await.expect("open");
+        let mut s = svc(pool.clone(), happy_mocks());
+        // Port 1 on loopback: connection refused at once, so verify_remote
+        // answers "could not look".
+        s.remote_backup = Some(RemoteBackupConfig {
+            scheme: "ftp".into(),
+            host: "127.0.0.1".into(),
+            port: 1,
+            user: "u".into(),
+            password: "p".into(),
+            base_path: "/backups".into(),
+        });
+        let dir = tempfile::tempdir().expect("dir");
+        let cfg = dir.path().join("agent.toml");
+        std::fs::write(&cfg, "[backup]\ndrop_local_after_offsite = true\n").expect("cfg");
+        s.agent_config_path = Some(cfg);
+        s.create(req("keep.cz")).await.expect("create");
+        let sel = HostingSelector::Domain(Domain::parse("keep.cz").unwrap());
+        let detail = s.get(sel.clone()).await.expect("get");
+
+        let archive = dir.path().join("keep.cz-100.tar.gz");
+        let manifest = dir.path().join("keep.cz-100.manifest.json");
+        std::fs::write(&archive, b"archive-bytes").expect("archive");
+        std::fs::write(&manifest, b"{}").expect("manifest");
+        let run = backups::start(&pool, &detail.id, "local", 100)
+            .await
+            .expect("start");
+        backups::mark_ok(&pool, run, &archive.display().to_string(), None, 13, 101)
+            .await
+            .expect("ok");
+        backups::set_remote(&pool, run, "ftp://x/keep.cz-100.tar.gz", "verified", "")
+            .await
+            .expect("remote");
+
+        let audit_fails = |pool: SqlitePool| async move {
+            hyperion_state::audit::list(&pool, 1000)
+                .await
+                .expect("audit")
+                .into_iter()
+                .filter(|e| e.action == "hosting.backup.drop_local" && e.result == "failed")
+                .count()
+        };
+
+        let empty = std::collections::HashMap::new();
+        let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
+        assert_eq!(out, vec![(run, DropLocalOutcome::Unreachable)]);
+        assert!(archive.exists(), "could-not-look must never delete");
+        assert!(manifest.exists());
+        let row = backups::get_by_id(&pool, run).await.unwrap().unwrap();
+        assert!(row.archive_path.is_some());
+        assert!(row.local_note.contains("archive"), "{}", row.local_note);
+        assert_eq!(audit_fails(pool.clone()).await, 1);
+
+        // Same answer next time → no second audit row.
+        let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
+        assert_eq!(out, vec![(run, DropLocalOutcome::Unreachable)]);
+        assert_eq!(
+            audit_fails(pool.clone()).await,
+            1,
+            "reported once, not per backup"
+        );
+
+        // And the card shows the stored reason.
+        let list = s.backup_list(sel.clone(), 10).await.expect("list");
+        assert_eq!(list[0].local_kept, "unconfirmed");
+
+        // keep 1 → the only local copy is the newest: not even asked about.
+        let out = s.enforce_local_copies(&detail, 1, &[], &empty).await;
+        assert!(out.is_empty());
+
+        // The on-demand action on the same row: the silent re-check fails,
+        // the fallback push cannot reach the FTP either → counted failed,
+        // nothing deleted, no extra "kept" audit from the silent probe.
+        let r = s
+            .backup_offsite_push_drop(sel, vec![run], vec![], true)
+            .await
+            .expect("push-drop");
+        assert_eq!((r.dropped, r.already_offsite, r.failed), (0, 0, 1));
+        assert!(archive.exists());
+        assert_eq!(audit_fails(pool.clone()).await, 1);
+    }
+
+    /// The other ways a candidate is NOT a kept copy, against a destination
+    /// that cannot be reached (so nothing could ever be confirmed — whatever
+    /// happens here happens without an off-site answer):
+    ///   * a busy archive (a restore is reading it) is left alone entirely;
+    ///   * an archive already gone from disk, dump too, gets its row set
+    ///     straight and is reported missing — never "kept", never deleted;
+    ///   * an archive gone with its dump still there sends the dump alone
+    ///     through the gate, and the reason names the dump.
+    #[tokio::test]
+    async fn drop_local_busy_missing_and_dump_only() {
+        use hyperion_state::backups;
+        let pool = open_memory().await.expect("open");
+        let mut s = svc(pool.clone(), happy_mocks());
+        s.remote_backup = Some(RemoteBackupConfig {
+            scheme: "ftp".into(),
+            host: "127.0.0.1".into(),
+            port: 1,
+            user: "u".into(),
+            password: "p".into(),
+            base_path: "/backups".into(),
+        });
+        s.create(req("odd.cz")).await.expect("create");
+        let sel = HostingSelector::Domain(Domain::parse("odd.cz").unwrap());
+        let detail = s.get(sel.clone()).await.expect("get");
+        let dir = tempfile::tempdir().expect("dir");
+        let empty = std::collections::HashMap::new();
+        let mk = |at: i64, archive: std::path::PathBuf, dump: Option<std::path::PathBuf>| {
+            let pool = pool.clone();
+            let id = detail.id.clone();
+            async move {
+                let r = backups::start(&pool, &id, "local", at)
+                    .await
+                    .expect("start");
+                let d = dump.map(|p| p.display().to_string());
+                backups::mark_ok(
+                    &pool,
+                    r,
+                    &archive.display().to_string(),
+                    d.as_deref(),
+                    1,
+                    at,
+                )
+                .await
+                .expect("ok");
+                backups::set_remote(&pool, r, "ftp://x/y", "verified", "")
+                    .await
+                    .expect("remote");
+                r
+            }
+        };
+
+        // Busy.
+        let busy_archive = dir.path().join("odd.cz-300.tar.gz");
+        std::fs::write(&busy_archive, b"x").expect("w");
+        let busy = mk(300, busy_archive.clone(), None).await;
+        {
+            let _restore = ArchiveInUse::claim(&busy_archive);
+            let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
+            assert_eq!(out.first(), Some(&(busy, DropLocalOutcome::Busy)));
+            let row = backups::get_by_id(&pool, busy).await.unwrap().unwrap();
+            assert!(row.archive_path.is_some());
+            assert_eq!(row.local_note, "", "busy is not a refusal");
+        }
+        // Released → asked again (and, unreachable, kept).
+        let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
+        assert_eq!(out.first(), Some(&(busy, DropLocalOutcome::Unreachable)));
+        backups::delete_by_id(&pool, busy).await.expect("rm");
+
+        // Missing: archive and dump both gone from disk.
+        let gone = mk(
+            200,
+            dir.path().join("odd.cz-200.tar.gz"),
+            Some(dir.path().join("odd.cz-200.sql")),
+        )
+        .await;
+        let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
+        assert_eq!(out, vec![(gone, DropLocalOutcome::MissingLocally)]);
+        let row = backups::get_by_id(&pool, gone).await.unwrap().unwrap();
+        assert_eq!((row.archive_path, row.db_dump_path), (None, None));
+        assert_eq!(
+            row.remote_state, "verified",
+            "the off-site record is untouched"
+        );
+
+        // Dump only: archive gone, dump still on disk → the dump is checked.
+        let dump = dir.path().join("odd.cz-100.sql");
+        std::fs::write(&dump, b"sql").expect("w");
+        let half = mk(
+            100,
+            dir.path().join("odd.cz-100.tar.gz"),
+            Some(dump.clone()),
+        )
+        .await;
+        let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
+        assert_eq!(out, vec![(half, DropLocalOutcome::Unreachable)]);
+        assert!(dump.exists());
+        let row = backups::get_by_id(&pool, half).await.unwrap().unwrap();
+        assert!(
+            row.local_note.contains("database dump"),
+            "{}",
+            row.local_note
+        );
+
+        // The on-demand action on a row that is on record off-site but whose
+        // archive is gone: counted missing — not "failed", not "kept" — and
+        // nothing is pushed.
+        let gone2 = mk(50, dir.path().join("odd.cz-50.tar.gz"), None).await;
+        let r = s
+            .backup_offsite_push_drop(sel.clone(), vec![gone2], vec![], true)
+            .await
+            .expect("push-drop");
+        assert_eq!(
+            (r.missing_locally, r.failed, r.kept_local, r.dropped),
+            (1, 0, 0, 0)
+        );
+    }
+
     /// The "Backups on disk" figure must count a backup ONLY while its archive
     /// is still on disk, and the per-site review must credit a dropped-then-
     /// off-site copy under off-site — otherwise "I deleted it locally and it's
diff --git a/crates/hyperion-state/migrations.sha256 b/crates/hyperion-state/migrations.sha256
index 3b7d729b..3c1db3e5 100644
--- a/crates/hyperion-state/migrations.sha256
+++ b/crates/hyperion-state/migrations.sha256
@@ -73,3 +73,4 @@ da43ff0f31d880df8c3202aa312118221634df5662c2e76e10489a32994fe809  071_care_packa
 2a85765e784eb3ec3bedf5a6621ea0a1268eb1d97a45bf11278fc74b5d95f954  073_job_substeps.sql
 f6e05abd8a92297dbe93d88038844258c5f4023b8dd817ef3bffe959bd82c383  074_net_samples.sql
 76c69a4cdf97a9fc59bc8aeef683286b103e1e2412ea8ed218f782f5539e993a  075_care_plan_validity_and_report_sections.sql
+67462d6d38ff3d6bc9fc2c965adc3ea5f51735e0fd76568bb93ef672ed1aa6a0  076_backup_local_note.sql
diff --git a/crates/hyperion-state/migrations/076_backup_local_note.sql b/crates/hyperion-state/migrations/076_backup_local_note.sql
new file mode 100644
index 00000000..02088a27
--- /dev/null
+++ b/crates/hyperion-state/migrations/076_backup_local_note.sql
@@ -0,0 +1,26 @@
+-- Why the LOCAL copy of a backup is still on disk when the operator asked for
+-- local copies to be dropped once they are verified off-site.
+--
+-- The drop step re-checks every file off-site before it deletes anything, and
+-- keeps the local copy when it cannot confirm one. Until now that refusal was
+-- written only to the admin audit log, so the Backups card showed
+-- "off-site ✓" next to a local path with nothing to say why the copy stayed —
+-- which reads as a broken delete. This column carries the reason to the row
+-- itself. NULL/empty = nothing to report (the reasons that follow from the
+-- settings, e.g. "the drop option is off", are derived when the list is read,
+-- not stored, so they can never go stale).
+ALTER TABLE backup_runs ADD COLUMN local_note TEXT;
+
+-- The S3 targets this run's push reached IN FULL (every file uploaded; for an
+-- age-encrypted target, age exited 0, so the whole ciphertext streamed), as a
+-- JSON array of target names. NULL = none on record.
+--
+-- An S3 push never wrote `remote_state` (that column is the FTP target's), so
+-- nothing on the row said an S3-only backup was off-site at all: the drop-local
+-- step could act on such a run only in the minute its own push finished, and a
+-- site set to keep its newest local copies never had an older one dropped. An
+-- age-encrypted object can only be checked for EXISTENCE later, and existence
+-- alone cannot tell a whole ciphertext from a truncated one — this record of a
+-- complete push is what makes that check meaningful. A failed re-push to a
+-- target removes it from the list.
+ALTER TABLE backup_runs ADD COLUMN s3_ok_targets TEXT;
diff --git a/crates/hyperion-state/src/backups.rs b/crates/hyperion-state/src/backups.rs
index bcde9044..da32f9cb 100644
--- a/crates/hyperion-state/src/backups.rs
+++ b/crates/hyperion-state/src/backups.rs
@@ -40,6 +40,24 @@ pub struct BackupRun {
     /// to. Set for `OffsiteSource::NotWanted` runs; keeps them out of the
     /// off-site push + drop paths.
     pub no_offsite: bool,
+    /// Why the local copy is still on disk although local copies were to be
+    /// dropped once verified off-site — written by the drop step when it
+    /// could not confirm a file off-site. Empty = nothing to report.
+    pub local_note: String,
+    /// The S3 targets a push of this run reached IN FULL (every file; for an
+    /// age-encrypted target, the whole ciphertext). The S3 push writes no
+    /// `remote_state`, so this is the only record that an S3-only backup is
+    /// off-site — and, for an age target, what makes a later existence check
+    /// mean "the complete copy is there". Sorted, deduplicated.
+    pub s3_ok_targets: Vec<String>,
+}
+
+impl BackupRun {
+    /// Is there a record that this run has an off-site copy: the FTP push
+    /// returned success (`ok`) or was verified, or an S3 push completed.
+    pub fn offsite_on_record(&self) -> bool {
+        matches!(self.remote_state.as_str(), "ok" | "verified") || !self.s3_ok_targets.is_empty()
+    }
 }
 
 /// The row as SQLite hands it back, mapped BY NAME.
@@ -71,6 +89,10 @@ struct BackupRunRow {
     error_message: Option<String>,
     #[sqlx(default)]
     no_offsite: Option<i64>,
+    #[sqlx(default)]
+    local_note: Option<String>,
+    #[sqlx(default)]
+    s3_ok_targets: Option<String>,
 }
 
 impl From<BackupRunRow> for BackupRun {
@@ -91,13 +113,30 @@ impl From<BackupRunRow> for BackupRun {
             bytes_total: r.bytes_total,
             error_message: r.error_message,
             no_offsite: r.no_offsite.unwrap_or(0) != 0,
+            local_note: r.local_note.unwrap_or_default(),
+            s3_ok_targets: parse_target_list(r.s3_ok_targets.as_deref()),
         }
     }
 }
 
 const SELECT_COLS: &str = "id, hosting_id, target, started_at, finished_at, state, \
      sha256_hex, remote_blob_key, remote_state, remote_error, archive_path, \
-     db_dump_path, bytes_total, error_message, no_offsite";
+     db_dump_path, bytes_total, error_message, no_offsite, local_note, s3_ok_targets";
+
+/// The stored JSON array of S3 target names, sorted and deduplicated. Anything
+/// unreadable is "none on record" — the safe reading, since this list can only
+/// ever ADD evidence that a copy is off-site.
+fn parse_target_list(raw: Option<&str>) -> Vec<String> {
+    let mut v: Vec<String> = raw
+        .and_then(|s| serde_json::from_str::<Vec<String>>(s).ok())
+        .unwrap_or_default()
+        .into_iter()
+        .filter(|n| !n.is_empty())
+        .collect();
+    v.sort();
+    v.dedup();
+    v
+}
 
 pub async fn start(
     pool: &SqlitePool,
@@ -251,11 +290,6 @@ pub async fn set_remote(
     Ok(())
 }
 
-/// Successful local backups with no off-site copy, oldest first.
-///
-/// What a backfill works from. `state='ok'` because pushing the archive of a
-/// failed run would copy a file that may be truncated; oldest first because
-/// the oldest is the one closest to being pruned off local disk.
 /// Flag a run as never-off-site (a rollback snapshot). Keeps it out of
 /// `list_needing_offsite` and, defensively, out of the on-demand push+drop.
 pub async fn mark_no_offsite(pool: &SqlitePool, id: i64) -> Result<(), StateError> {
@@ -266,6 +300,11 @@ pub async fn mark_no_offsite(pool: &SqlitePool, id: i64) -> Result<(), StateErro
     Ok(())
 }
 
+/// Successful local backups with no off-site copy, oldest first.
+///
+/// What a backfill works from. `state='ok'` because pushing the archive of a
+/// failed run would copy a file that may be truncated; oldest first because
+/// the oldest is the one closest to being pruned off local disk.
 pub async fn list_needing_offsite(
     pool: &SqlitePool,
     limit: i64,
@@ -298,14 +337,75 @@ pub async fn list_needing_offsite(
 /// This also keeps `list_needing_offsite` honest: it filters
 /// `archive_path IS NOT NULL`, so a run whose local file is gone is correctly
 /// no longer a candidate to "copy off-site" (there is nothing local to send).
+///
+/// The row's `local_note` goes with them: it explains why a local copy is
+/// still on disk, and there no longer is one.
 pub async fn clear_local_paths(pool: &SqlitePool, id: i64) -> Result<(), StateError> {
-    sqlx::query("UPDATE backup_runs SET archive_path = NULL, db_dump_path = NULL WHERE id = ?")
+    sqlx::query(
+        "UPDATE backup_runs SET archive_path = NULL, db_dump_path = NULL, local_note = NULL \
+         WHERE id = ?",
+    )
+    .bind(id)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+/// Record (or, with `""`, clear) why the local copy of a run is still on
+/// disk although the drop-local option asked for it to go.
+pub async fn set_local_note(pool: &SqlitePool, id: i64, note: &str) -> Result<(), StateError> {
+    sqlx::query("UPDATE backup_runs SET local_note = ? WHERE id = ?")
+        .bind(if note.is_empty() { None } else { Some(note) })
         .bind(id)
         .execute(pool)
         .await?;
     Ok(())
 }
 
+/// Record the S3 targets a push of this run reached in full (see
+/// `BackupRun::s3_ok_targets`). An empty list stores NULL.
+pub async fn set_s3_ok_targets(
+    pool: &SqlitePool,
+    id: i64,
+    targets: &[String],
+) -> Result<(), StateError> {
+    let mut v: Vec<&String> = targets.iter().filter(|n| !n.is_empty()).collect();
+    v.sort();
+    v.dedup();
+    let json = if v.is_empty() {
+        None
+    } else {
+        Some(serde_json::to_string(&v).unwrap_or_else(|_| "[]".into()))
+    };
+    sqlx::query("UPDATE backup_runs SET s3_ok_targets = ? WHERE id = ?")
+        .bind(json)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Hostings that still hold a LOCAL copy of a backup which has an off-site
+/// copy on record (FTP `remote_state` ok or verified, or an S3 push that
+/// completed) — the ones a "drop local copies that are already off-site"
+/// sweep has work on. Rollback snapshots never qualify.
+pub async fn hostings_with_offsite_local_copies(
+    pool: &SqlitePool,
+) -> Result<Vec<HostingId>, StateError> {
+    let rows: Vec<(String,)> = sqlx::query_as(
+        "SELECT DISTINCT hosting_id FROM backup_runs \
+          WHERE state = 'ok' \
+            AND archive_path IS NOT NULL \
+            AND no_offsite = 0 \
+            AND (remote_state IN ('ok', 'verified') \
+                 OR (s3_ok_targets IS NOT NULL AND s3_ok_targets NOT IN ('', '[]'))) \
+          ORDER BY hosting_id",
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows.into_iter().map(|(h,)| HostingId(h)).collect())
+}
+
 pub async fn delete_by_id(pool: &SqlitePool, id: i64) -> Result<(), StateError> {
     sqlx::query("DELETE FROM backup_runs WHERE id = ?")
         .bind(id)
@@ -503,6 +603,147 @@ mod tests {
         assert!(!after.iter().any(|r| r.id == run));
     }
 
+    /// Write-then-read-back: a missing `.bind()` here would silently update
+    /// `WHERE id = NULL` and the note would never reach the Backups card.
+    #[tokio::test]
+    async fn local_note_round_trips_and_clears_with_the_local_paths() {
+        let pool = open_memory().await.expect("open");
+        let id = fixture(&pool).await;
+        let run = start(&pool, &id, "local", 100).await.expect("start");
+        mark_ok(&pool, run, "/b/ex.tar.gz", Some("/b/ex.sql"), 10, 200)
+            .await
+            .expect("ok");
+        let other = start(&pool, &id, "local", 300).await.expect("start2");
+        mark_ok(&pool, other, "/b/ex2.tar.gz", None, 10, 400)
+            .await
+            .expect("ok2");
+
+        assert_eq!(get_by_id(&pool, run).await.unwrap().unwrap().local_note, "");
+        set_local_note(&pool, run, "kept: dump not confirmed")
+            .await
+            .expect("note");
+        assert_eq!(
+            get_by_id(&pool, run).await.unwrap().unwrap().local_note,
+            "kept: dump not confirmed"
+        );
+        assert_eq!(
+            get_by_id(&pool, other).await.unwrap().unwrap().local_note,
+            "",
+            "the note lands on the named row only"
+        );
+        // "" clears it.
+        set_local_note(&pool, run, "").await.expect("clear note");
+        assert_eq!(get_by_id(&pool, run).await.unwrap().unwrap().local_note, "");
+
+        // Dropping the local copy takes the note with it: there is no longer a
+        // local copy for it to explain.
+        set_local_note(&pool, run, "kept").await.expect("note2");
+        clear_local_paths(&pool, run).await.expect("clear");
+        let r = get_by_id(&pool, run).await.unwrap().unwrap();
+        assert_eq!(r.archive_path, None);
+        assert_eq!(r.local_note, "");
+    }
+
+    /// Only hostings with a still-local copy of a backup that is on record as
+    /// off-site are work for the "drop what is already off-site" sweep.
+    #[tokio::test]
+    async fn hostings_with_offsite_local_copies_filters_to_real_work() {
+        let pool = open_memory().await.expect("open");
+        let id = fixture(&pool).await;
+        // Local, never off-site → not work for this sweep.
+        let local = start(&pool, &id, "local", 100).await.expect("s1");
+        mark_ok(&pool, local, "/b/a.tar.gz", None, 1, 110)
+            .await
+            .expect("ok1");
+        assert!(hostings_with_offsite_local_copies(&pool)
+            .await
+            .unwrap()
+            .is_empty());
+
+        // A rollback snapshot that somehow carries an off-site state → still
+        // never work.
+        let snap = start(&pool, &id, "local", 200).await.expect("s2");
+        mark_ok(&pool, snap, "/b/s.tar.gz", None, 1, 210)
+            .await
+            .expect("ok2");
+        mark_no_offsite(&pool, snap).await.expect("mark");
+        set_remote(&pool, snap, "ftp://x/s.tar.gz", "verified", "")
+            .await
+            .expect("remote");
+        assert!(hostings_with_offsite_local_copies(&pool)
+            .await
+            .unwrap()
+            .is_empty());
+
+        // Verified off-site and still local → work.
+        set_remote(&pool, local, "ftp://x/a.tar.gz", "verified", "")
+            .await
+            .expect("remote2");
+        assert_eq!(
+            hostings_with_offsite_local_copies(&pool).await.unwrap(),
+            vec![id.clone()]
+        );
+
+        // Local copy gone → no longer work.
+        clear_local_paths(&pool, local).await.expect("clear");
+        assert!(hostings_with_offsite_local_copies(&pool)
+            .await
+            .unwrap()
+            .is_empty());
+
+        // An S3-only backup (no FTP state at all) with a completed push is
+        // work too — the S3 push writes no remote_state.
+        let s3 = start(&pool, &id, "local", 300).await.expect("s3");
+        mark_ok(&pool, s3, "/b/c.tar.gz", None, 1, 310)
+            .await
+            .expect("ok3");
+        assert!(hostings_with_offsite_local_copies(&pool)
+            .await
+            .unwrap()
+            .is_empty());
+        set_s3_ok_targets(&pool, s3, &["vault".to_string()])
+            .await
+            .expect("s3 ok");
+        assert_eq!(
+            hostings_with_offsite_local_copies(&pool).await.unwrap(),
+            vec![id.clone()]
+        );
+    }
+
+    /// Write-then-read-back of the S3 evidence list, including "clear".
+    #[tokio::test]
+    async fn s3_ok_targets_round_trip_sorted_and_clearable() {
+        let pool = open_memory().await.expect("open");
+        let id = fixture(&pool).await;
+        let run = start(&pool, &id, "local", 100).await.expect("start");
+        mark_ok(&pool, run, "/b/a.tar.gz", None, 1, 110)
+            .await
+            .expect("ok");
+        let r = get_by_id(&pool, run).await.unwrap().unwrap();
+        assert!(r.s3_ok_targets.is_empty());
+        assert!(!r.offsite_on_record());
+
+        set_s3_ok_targets(&pool, run, &["b".into(), "a".into(), "b".into(), "".into()])
+            .await
+            .expect("set");
+        let r = get_by_id(&pool, run).await.unwrap().unwrap();
+        assert_eq!(r.s3_ok_targets, vec!["a".to_string(), "b".to_string()]);
+        assert!(r.offsite_on_record());
+
+        // Clearing the local copy keeps the off-site evidence.
+        clear_local_paths(&pool, run).await.expect("clear");
+        let r = get_by_id(&pool, run).await.unwrap().unwrap();
+        assert_eq!(r.s3_ok_targets.len(), 2);
+
+        set_s3_ok_targets(&pool, run, &[]).await.expect("empty");
+        assert!(get_by_id(&pool, run)
+            .await
+            .unwrap()
+            .unwrap()
+            .s3_ok_targets
+            .is_empty());
+    }
+
     #[tokio::test]
     async fn no_offsite_runs_are_never_offsite_candidates() {
         let pool = open_memory().await.expect("open");
diff --git a/crates/hyperion-types/src/limits.rs b/crates/hyperion-types/src/limits.rs
index 22a261d9..15ec5658 100644
--- a/crates/hyperion-types/src/limits.rs
+++ b/crates/hyperion-types/src/limits.rs
@@ -270,6 +270,27 @@ pub struct BackupRunWire {
     /// no local drop. The UI hides the "copy off-site & drop" control for it.
     #[serde(default)]
     pub no_offsite: bool,
+    /// Why this backup's LOCAL copy is still on disk although it is on record
+    /// as off-site — so "off-site ✓" next to a local path never reads as a
+    /// delete that silently failed. One of:
+    ///   * `""` — nothing to explain (no local copy, no off-site copy on
+    ///     record, a rollback snapshot, or an older node that does not say);
+    ///   * `"setting_off"` — "Delete the local copy once it is verified
+    ///     off-site" is off on the node that owns the site;
+    ///   * `"keep_newest"` — the option is on, but this is one of the newest
+    ///     local copies the node is set to keep;
+    ///   * `"unconfirmed"` — the option is on, but the drop step could not
+    ///     confirm every file off-site, so it kept the copy.
+    #[serde(default)]
+    pub local_kept: String,
+    /// The same, in words, for a tooltip/sub-line. Empty when `local_kept` is.
+    #[serde(default)]
+    pub local_note: String,
+    /// The S3 targets a push of this backup reached in full. The S3 push
+    /// writes no `remote_state` (that is the FTP target's), so for an
+    /// S3-only backup this is the only sign it is off-site.
+    #[serde(default)]
+    pub s3_ok_targets: Vec<String>,
 }
 
 impl BackupRunWire {
@@ -279,12 +300,29 @@ impl BackupRunWire {
             "verified" => ("off-site ✓", "pill ok"),
             "ok" => ("uploaded", "pill"),
             "failed" => ("off-site FAILED", "pill danger"),
+            // No FTP state, but an S3 push completed: "uploaded", the same
+            // claim strength as an FTP `ok` — the push succeeded, nobody
+            // listed the copy back.
+            _ if !self.s3_ok_targets.is_empty() => ("uploaded", "pill"),
             // Nothing recorded. On a run older than the feature this means
             // "we do not know", and saying "no" would be a claim we cannot
             // support.
             _ => ("—", "pill"),
         }
     }
+
+    /// A few words under the off-site pill for why the LOCAL copy is still on
+    /// disk (see `local_kept`); the full reason goes in its tooltip. Empty when
+    /// there is nothing to explain.
+    pub fn local_kept_label(&self) -> &'static str {
+        match self.local_kept.as_str() {
+            "setting_off" => "local copy kept",
+            "keep_newest" => "kept locally (newest)",
+            "unconfirmed" => "local kept: not confirmed off-site",
+            "pending" => "local copy: drops at next backup",
+            _ => "",
+        }
+    }
 }
 
 /// What a `BackupRestore` should put back. Lets the operator restore
@@ -424,6 +462,11 @@ pub struct OffsiteBackfillResult {
     /// conservative re-verify simply refused to license a delete.
     #[serde(default)]
     pub kept_local: i64,
+    /// Of `dropped`: local copies that were ALREADY on record as off-site, so
+    /// they were re-checked where they are and dropped without being sent
+    /// again. Lets the job log say why `pushed` is lower than `dropped`.
+    #[serde(default)]
+    pub already_offsite: i64,
 }
 
 /// One IP ban as shown in the UI / returned over the wire.
diff --git a/crates/hyperion-types/src/stats.rs b/crates/hyperion-types/src/stats.rs
index dc1f5afd..95f54028 100644
--- a/crates/hyperion-types/src/stats.rs
+++ b/crates/hyperion-types/src/stats.rs
@@ -990,6 +990,12 @@ pub struct BackupConfigView {
     /// Off by default: keeping the local copy means a fast restore and a
     /// second copy, at the cost of disk.
     pub drop_local_after_offsite: bool,
+    /// With `drop_local_after_offsite` on: how many of each site's newest
+    /// local copies stay on disk anyway (a fast restore without a download).
+    /// 0 = drop every local copy that is verified off-site. `#[serde(default)]`
+    /// so an older agent's view (no such key) still deserializes.
+    #[serde(default)]
+    pub keep_local_latest: i64,
 }
 
 /// The agent's own defaults (`BackupRetentionSection`), NOT zeros. An
diff --git a/packaging/agent.toml.example b/packaging/agent.toml.example
index c9a39785..8fe5f768 100644
--- a/packaging/agent.toml.example
+++ b/packaging/agent.toml.example
@@ -231,20 +231,26 @@ mail_threshold = 8    # postfix/dovecot SASL auth failures
 #
 # Backups always land on local disk first, then a copy is pushed off-site (the
 # [backup_remote] FTP target and/or the S3 targets set per hosting). With
-# `drop_local_after_offsite = true`, the local archive + DB dump are deleted
-# after each backup — but ONLY once the off-site copy has been INDEPENDENTLY
-# re-verified present (size-checked for FTP and unencrypted S3; existence-only
-# for age-encrypted S3, whose ciphertext size cannot match the plaintext).
-# Never on a bare "upload returned success", and never for a run that had no
-# off-site destination. If any file cannot be confirmed, the local copy is
-# kept and a warning is logged. Restore then comes from the site's Off-site
+# `drop_local_after_offsite = true`, after each backup of a site the local
+# archive + DB dump are deleted — of this backup and of any older backup of the
+# site already on record as off-site — but ONLY once each off-site copy has
+# been INDEPENDENTLY re-verified present (size-checked for FTP and unencrypted
+# S3; existence-only for age-encrypted S3, whose ciphertext size cannot match
+# the plaintext, and then only right after a full push of it). Never on a bare
+# "upload returned success", and never for a run that had no off-site
+# destination. If any file cannot be confirmed, the local copy is kept and the
+# site's Backups tab says why. Restore then comes from the site's Off-site
 # panel. Read on the node that owns each site (its backup run acts on it).
 #
+# `keep_local_latest = N` keeps each site's N newest local copies on disk even
+# so (a fast restore without a download); 0 drops every verified copy.
+#
 # Default false: keeping the local copy means a faster restore and a second
 # copy, at the cost of disk.
 #
 # [backup]
 # drop_local_after_offsite = false
+# keep_local_latest = 0
 
 # ─── Snapshots before a change ─────────────────────────────────────────────
 #

From f2fdccd0d66590f8d193d972346c27680b25654d Mon Sep 17 00:00:00 2001
From: mkn <matej@nechodom.cz>
Date: Mon, 5 Oct 2026 14:25:45 +0200
Subject: [PATCH 2/2] fix(backup): close the remaining drop races and
 stale-evidence holes

Second adversarial review of the local-copy drop:

- "Off-site & drop" pushed and then deleted through the gate without asking
  the in-use registry, so it could delete an archive a restore was reading.
  The gate now reserves the archive atomically right before deleting (refused
  while anyone but the caller holds it), and a restore or push cannot start
  on an archive being deleted (the restore says to use the Off-site panel).
  The early busy check alone missed restores that started during the
  minutes-long off-site re-check.
- Before deleting, the gate re-reads the row and refuses if its paths or S3
  evidence moved since it was checked; a sweep reads each run fresh instead
  of from a list that can be minutes old (a failed re-push may have taken an
  age target off the run's evidence meanwhile).
- S3 evidence is recorded as the target name plus a fingerprint of endpoint,
  bucket and age recipient. Editing a target in place to a new recipient
  (old identity lost) no longer lets the old, now undecryptable objects
  "confirm" a copy by existence.
- Files listed on a row but not on disk are no longer cleared from the row:
  an unmounted backup volume looks exactly like that. The row keeps its
  paths, gets a note, and shows "local files not on disk".
- FTP "no such file/dir" answers (curl 9/19/21/78) count as an answer about
  that file, so the sweep moves on instead of treating the server as down.
- An unreadable keep count also stops the estate "Copy off-site & delete
  local" sweep (it read it as 0) and the job says why.
- push_run_offsite no longer stamps "off-site FAILED" on a run whose local
  archive is gone but which is on record off-site.
- Backfill no longer re-uploads runs with a completed S3 push.
- A stored "could not confirm" note is cleared once the copy is kept on
  purpose (inside the keep window or without an off-site record).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 bin/hyperion-web/src/handlers/settings.rs     |   4 +
 .../templates/hostings_detail.html            |   2 +-
 crates/hyperion-core/src/service.rs           | 565 ++++++++++++++----
 crates/hyperion-state/src/backups.rs          |  24 +-
 crates/hyperion-types/src/limits.rs           |  23 +-
 5 files changed, 504 insertions(+), 114 deletions(-)

diff --git a/bin/hyperion-web/src/handlers/settings.rs b/bin/hyperion-web/src/handlers/settings.rs
index 835380ef..da04a310 100644
--- a/bin/hyperion-web/src/handlers/settings.rs
+++ b/bin/hyperion-web/src/handlers/settings.rs
@@ -2129,6 +2129,9 @@ pub async fn post_offsite_backfill(
                              continue.\n",
                         );
                     }
+                    if !r.note.is_empty() {
+                        log.push_str(&format!("\n{}\n", r.note));
+                    }
                     reporter.step("Finished.", 100, &log).await;
                     // A kept copy is not a failure of the sweep, but with
                     // "delete local" asked for it is not done either — say so
@@ -2142,6 +2145,7 @@ pub async fn post_offsite_backfill(
                             if r.kept_local == 1 { "y was" } else { "ies were" },
                         )
                         });
+                    let kept = kept.or_else(|| (!r.note.is_empty()).then(|| r.note.clone()));
                     reporter.finish(r.failed == 0 && kept.is_none(), kept).await;
                 }
                 Ok(RpcResponse::Error(e)) => reporter.finish(false, Some(e.to_string())).await,
diff --git a/bin/hyperion-web/templates/hostings_detail.html b/bin/hyperion-web/templates/hostings_detail.html
index 0382d247..0099da2b 100644
--- a/bin/hyperion-web/templates/hostings_detail.html
+++ b/bin/hyperion-web/templates/hostings_detail.html
@@ -3435,7 +3435,7 @@ <h2>
                 back at the right size. An em dash means we have no record. -#}
             <td>
               <span class="{{ b.offsite_label().1 }}" style="font-size:0.6rem"
-                    title="{% if !b.remote_error.is_empty() %}{{ b.remote_error }}{% else if !b.remote_blob_key.is_empty() %}{{ b.remote_blob_key }}{% else if !b.s3_ok_targets.is_empty() %}Pushed in full to S3: {{ b.s3_ok_targets.join(", ") }}{% else %}No off-site copy is recorded for this backup{% endif %}">{{ b.offsite_label().0 }}</span>
+                    title="{% if !b.remote_error.is_empty() %}{{ b.remote_error }}{% else if !b.remote_blob_key.is_empty() %}{{ b.remote_blob_key }}{% else if !b.s3_ok_targets.is_empty() %}Pushed in full to S3: {{ b.s3_target_names() }}{% else %}No off-site copy is recorded for this backup{% endif %}">{{ b.offsite_label().0 }}</span>
               {%- if !b.sha256_hex.is_empty() %}
               <span class="cell-sub" style="font-size:0.6rem" title="Content digest recorded when the archive was made: {{ b.sha256_hex }}">fingerprinted</span>
               {%- endif %}
diff --git a/crates/hyperion-core/src/service.rs b/crates/hyperion-core/src/service.rs
index 4730a940..a0c55eeb 100644
--- a/crates/hyperion-core/src/service.rs
+++ b/crates/hyperion-core/src/service.rs
@@ -6629,8 +6629,9 @@ impl<A: AdapterPort + 'static> HostingService<A> {
     /// + streamed when a recipient is set), prunes the remote to the newest
     /// `retention_daily` backups, and audits one row per target. Never errors.
     ///
-    /// Returns the names of the targets whose push FULLY succeeded (every file
-    /// uploaded). The drop-local step needs this for age-encrypted targets:
+    /// Returns the evidence keys (`s3_evidence_key`: name + a fingerprint of
+    /// endpoint, bucket and age recipient) of the targets whose push FULLY
+    /// succeeded (every file uploaded). The drop-local step needs this for age-encrypted targets:
     /// their off-site copy can only be re-verified by EXISTENCE (the ciphertext
     /// size cannot match the plaintext), and an age stream that dies part-way
     /// can leave a non-empty but truncated — undecryptable — object behind
@@ -6688,7 +6689,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             if !ok {
                 tracing::warn!(domain=%detail.domain, target=%row.name, note=%summary, "S3 backup push failed");
             } else {
-                fully_ok.push(row.name.clone());
+                fully_ok.push(s3_evidence_key(row));
             }
             self.audit_s3(detail, &row.name, ok, &summary).await;
         }
@@ -6717,14 +6718,14 @@ impl<A: AdapterPort + 'static> HostingService<A> {
     /// rows qualify). Returns each attempted run with what happened to it.
     ///
     /// `push_evidence` holds the runs pushed moments ago by the caller (the
-    /// backup that just finished, or a backfill's uploads), mapped to the S3
-    /// targets each push FULLY succeeded to. Those runs are candidates even
-    /// before their row is updated, and — merged with the targets the row
-    /// itself records (`s3_ok_targets`) — the target set is what lets an
-    /// age-encrypted target confirm a copy (see `file_is_offsite`). Anything
-    /// else is confirmed by FTP size or unencrypted S3 size alone — which is the
-    /// point: a copy that is already off-site is dropped without being sent
-    /// again.
+    /// backup that just finished, or a backfill's uploads). Those runs are
+    /// candidates whatever their row says. The S3 evidence an age-encrypted
+    /// target needs (see `file_is_offsite`) is read from each run's row, FRESH,
+    /// at the moment it is checked — the pushes above already wrote it there,
+    /// and a later push that failed has already taken it away again. Anything
+    /// else is confirmed by FTP size or unencrypted S3 size alone — which is
+    /// the point: a copy that is already off-site is dropped without being
+    /// sent again.
     ///
     /// Stops at the first run whose off-site copy could not be LOOKED at
     /// (every destination failed to answer): the next run would ask the same
@@ -6746,24 +6747,24 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             }
         };
         let just_pushed: std::collections::HashSet<i64> = push_evidence.keys().copied().collect();
+        let candidates = local_copies_to_drop(&rows, keep_latest, &just_pushed);
+        // A stored "could not confirm" belongs to a copy the drop step will
+        // still ask about. One the node now keeps on purpose (inside the keep
+        // window, or with no off-site record) would otherwise show a stale
+        // warning until retention removes it.
+        for r in rows
+            .iter()
+            .filter(|r| is_local_copy(r) && !r.local_note.is_empty() && !candidates.contains(&r.id))
+        {
+            let _ = hyperion_state::backups::set_local_note(&self.pool, r.id, "").await;
+        }
         let mut done = Vec::new();
-        for id in local_copies_to_drop(&rows, keep_latest, &just_pushed) {
+        for id in candidates {
             let Some(run) = rows.iter().find(|r| r.id == id) else {
                 continue;
             };
-            let mut evidence: std::collections::HashSet<String> =
-                run.s3_ok_targets.iter().cloned().collect();
-            if let Some(more) = push_evidence.get(&id) {
-                evidence.extend(more.iter().cloned());
-            }
             let outcome = self
-                .drop_run_local_if_offsite(
-                    detail,
-                    run,
-                    s3_targets,
-                    &evidence,
-                    Some(&run.local_note),
-                )
+                .drop_run_local_if_offsite(detail, run.id, s3_targets, Some(&run.local_note))
                 .await;
             done.push((id, outcome));
             // Nowhere off-site to look, or nobody answered: no other run of
@@ -6778,28 +6779,33 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         done
     }
 
-    /// Hand one EXISTING run's local files to the verified-drop gate.
+    /// Hand one EXISTING run's local files to the verified-drop gate, from its
+    /// row as it is NOW (a sweep's list can be minutes old: a re-push may have
+    /// failed and taken a target off the run's S3 evidence since).
     ///
     /// * A run some operation on this node is using right now — a restore
     ///   reading it, a backup or a push still sending it — is left alone
-    ///   (`Busy`): deleting it would cut that operation off part-way.
+    ///   (`Busy`): deleting it would cut that operation off part-way. The gate
+    ///   checks again, atomically, right before it deletes.
     /// * Only the files still on disk are offered: a dump that was removed
     ///   separately has nothing left to lose, and asking the remote about a
     ///   file we cannot even stat would keep the archive forever.
-    /// * An archive that is already gone (removed by hand, lost with a disk)
-    ///   is not a drop: if its dump is gone too, the row is set straight —
-    ///   the local paths are cleared, since there is no local copy left to
-    ///   protect — and the run is reported `MissingLocally`, never as a copy
-    ///   that was "kept". If the dump is still there, the dump alone goes
-    ///   through the gate.
+    /// * When NONE of the run's files is on disk, nothing is deleted and the
+    ///   row is left as it is — absence alone is not proof (a backup volume
+    ///   that did not mount looks exactly like this, and clearing every row
+    ///   then would orphan every archive once it is back). The run is reported
+    ///   `MissingLocally`, with a note, never as a copy that was "kept".
     async fn drop_run_local_if_offsite(
         &self,
         detail: &hyperion_types::HostingDetail,
-        run: &hyperion_state::backups::BackupRun,
+        run_id: i64,
         s3_targets: &[&hyperion_types::S3BackupTarget],
-        s3_push_ok: &std::collections::HashSet<String>,
         record_keep: Option<&str>,
     ) -> DropLocalOutcome {
+        let run = match hyperion_state::backups::get_by_id(&self.pool, run_id).await {
+            Ok(Some(r)) if r.hosting_id == detail.id => r,
+            _ => return DropLocalOutcome::Kept,
+        };
         // Defence in depth: the callers already skip these, but this is the
         // one door every sweep goes through.
         if run.no_offsite || run.state != "ok" {
@@ -6812,7 +6818,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             return DropLocalOutcome::Busy;
         }
         // Exists / gone / could-not-look are three answers; only a definite
-        // "gone" licenses setting the row straight.
+        // "gone" is reported as missing.
         let archive_here = match tokio::fs::try_exists(archive).await {
             Ok(b) => b,
             Err(_) => return DropLocalOutcome::Kept,
@@ -6833,38 +6839,36 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             files.push(("database dump", d));
         }
         if files.is_empty() {
-            // Nothing of this run is on disk any more. The row still says
-            // otherwise; make it say what is true, so it stops being offered
-            // as a local copy (and stops reading "kept" on every sweep).
-            if hyperion_state::backups::clear_local_paths(&self.pool, run.id)
-                .await
-                .is_ok()
-            {
-                if let Some(m) = manifest_path_for(archive) {
-                    let _ = tokio::fs::remove_file(m).await;
+            if let Some(prev) = record_keep {
+                if prev != LOCAL_FILES_MISSING_NOTE {
+                    let _ = hyperion_state::backups::set_local_note(
+                        &self.pool,
+                        run.id,
+                        LOCAL_FILES_MISSING_NOTE,
+                    )
+                    .await;
+                    self.append_audit(
+                        "hosting.backup.drop_local",
+                        Some(detail.id.as_str()),
+                        &serde_json::json!({ "run_id": run.id, "note": LOCAL_FILES_MISSING_NOTE })
+                            .to_string(),
+                        "failed",
+                    )
+                    .await;
                 }
-                self.append_audit(
-                    "hosting.backup.drop_local",
-                    Some(detail.id.as_str()),
-                    &serde_json::json!({
-                        "run_id": run.id,
-                        "note": "the local copy was already gone from disk; the row no longer \
-                                 lists it (the off-site copy on record is untouched)"
-                    })
-                    .to_string(),
-                    "ok",
-                )
-                .await;
             }
             return DropLocalOutcome::MissingLocally;
         }
+        let evidence: std::collections::HashSet<String> =
+            run.s3_ok_targets.iter().cloned().collect();
         self.maybe_drop_local_after_offsite(
             detail,
-            run.id,
+            &run,
             archive,
             &files,
             s3_targets,
-            s3_push_ok,
+            &evidence,
+            0,
             record_keep,
         )
         .await
@@ -6896,17 +6900,26 @@ impl<A: AdapterPort + 'static> HostingService<A> {
     /// a warning and an audit row — the last two only when the reason differs
     /// from `prev`, the row's current note, so a copy that stays unconfirmed is
     /// not re-reported after every backup.
+    ///
+    /// `run` is the row as the caller read it; `own_claims` is how many holds
+    /// on the archive the caller itself has (1 when it pushed the file under a
+    /// claim, else 0). Before anything is cleared, the archive is reserved for
+    /// deletion — refused (`Busy`) while anyone else holds it — and the row is
+    /// read again: if its paths or its S3 evidence moved since `run` was read,
+    /// nothing is deleted.
     #[allow(clippy::too_many_arguments)]
     async fn maybe_drop_local_after_offsite(
         &self,
         detail: &hyperion_types::HostingDetail,
-        run_id: i64,
+        run: &hyperion_state::backups::BackupRun,
         archive_path: &std::path::Path,
         files: &[(&str, &std::path::Path)],
         s3_targets: &[&hyperion_types::S3BackupTarget],
         s3_push_ok: &std::collections::HashSet<String>,
+        own_claims: usize,
         record_keep: Option<&str>,
     ) -> DropLocalOutcome {
+        let run_id = run.id;
         // The FTP destination, if this node has one. Rebuilt here from the
         // same inputs the push uses rather than threaded through, so the
         // borrow stays local to this step.
@@ -6974,7 +6987,25 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             return outcome;
         }
 
-        // Every file is confirmed off-site. Clear the DB paths FIRST, then
+        // Every file is confirmed off-site. Reserve the archive for deletion:
+        // from here until the files are gone, no restore or push can start on
+        // it, and if one is running now, nothing is deleted.
+        let Some(_reservation) = try_reserve_drop(archive_path, own_claims) else {
+            return DropLocalOutcome::Busy;
+        };
+        // And the row must still be the one that was checked: same local
+        // files, same S3 evidence (a push that failed meanwhile takes its
+        // target off the list — the object it vouched for may now be cut
+        // short).
+        match hyperion_state::backups::get_by_id(&self.pool, run_id).await {
+            Ok(Some(now))
+                if now.archive_path == run.archive_path
+                    && now.db_dump_path == run.db_dump_path
+                    && now.s3_ok_targets == run.s3_ok_targets
+                    && !now.no_offsite => {}
+            _ => return DropLocalOutcome::Kept,
+        }
+        // Clear the DB paths FIRST, then
         // delete: if the process dies between the two, the worst case is a
         // harmless orphan file on disk (the next prune ignores it, since its
         // row no longer names it) rather than a row pointing at a file that is
@@ -7071,6 +7102,15 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             match hyperion_adapters::backup::verify_remote(file, &upload).await {
                 Ok(Some(true)) => return OffsiteCheck::Confirmed,
                 Ok(_) => answered += 1,
+                // Reached, logged in, and the server said no: no such
+                // directory (9), could not access the file (19), command
+                // refused (21), no such file (78). That is an ANSWER about
+                // this file — the next one may well be there.
+                Err(hyperion_adapters::AdapterError::Command { code, .. }) if ftp_said_no(code) => {
+                    answered += 1
+                }
+                // Transport failures (refused, timed out, TLS, login) stay
+                // "could not look".
                 Err(_) => {}
             }
         }
@@ -7106,7 +7146,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 // age target only counts with a complete push on record.
                 // Unencrypted needs no such gate: `n == local` below catches a
                 // short copy on its own.
-                if age && !s3_push_ok.contains(&row.name) {
+                if age && !s3_push_ok.contains(&s3_evidence_key(row)) {
                     continue;
                 }
                 let key = if age {
@@ -11342,16 +11382,20 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             return out;
         };
         // The row can name a file that is gone — removed by hand, or lost with
-        // a disk. Nothing left to send — record it and move on.
+        // a disk. Nothing left to send. Only a run with NO off-site copy on
+        // record is marked failed: one that is already off-site keeps that
+        // record, which is still true.
         if !tokio::fs::try_exists(&archive).await.unwrap_or(false) {
-            let _ = hyperion_state::backups::set_remote(
-                &self.pool,
-                run.id,
-                "",
-                "failed",
-                "the local archive is gone — pruned before it was ever copied off-site",
-            )
-            .await;
+            if !run.offsite_on_record() {
+                let _ = hyperion_state::backups::set_remote(
+                    &self.pool,
+                    run.id,
+                    "",
+                    "failed",
+                    "the local archive is gone — removed before it was ever copied off-site",
+                )
+                .await;
+            }
             out.missing_locally = true;
             return out;
         }
@@ -11361,8 +11405,12 @@ impl<A: AdapterPort + 'static> HostingService<A> {
         };
         let archive_path = std::path::PathBuf::from(&archive);
         // Busy while it is being sent, so a sweep elsewhere does not drop it
-        // mid-upload. This method's own drop below goes straight to the gate.
-        let _busy = ArchiveInUse::claim(&archive_path);
+        // mid-upload. A drop deleting it right now wins: there is nothing to
+        // send once it is gone, and it is gone because it was verified
+        // off-site.
+        let Some(_busy) = ArchiveInUse::try_claim(&archive_path) else {
+            return out;
+        };
         // Only offer the dump to a push (and to the drop gate) if it still
         // exists — a run may have been made before dumps were kept, or the
         // dump pruned separately.
@@ -11461,7 +11509,7 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             let mut on_record: std::collections::HashSet<String> = run
                 .s3_ok_targets
                 .iter()
-                .filter(|n| !attempted.contains(n.as_str()))
+                .filter(|k| !attempted.contains(s3_evidence_name(k)))
                 .cloned()
                 .collect();
             on_record.extend(s3_push_ok.iter().cloned());
@@ -11488,15 +11536,26 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             if let Some(d) = dump_path.as_deref() {
                 files.push(("database dump", d));
             }
+            // The row as this push left it (remote state, S3 evidence): the
+            // gate re-reads it before deleting and refuses if it moved.
+            let fresh = match hyperion_state::backups::get_by_id(&self.pool, run.id).await {
+                Ok(Some(r)) => r,
+                _ => {
+                    out.kept_local = true;
+                    out.s3_push_ok = s3_push_ok;
+                    return out;
+                }
+            };
             match self
                 .maybe_drop_local_after_offsite(
                     &detail,
-                    run.id,
+                    &fresh,
                     &archive_path,
                     &files,
                     &s3_pushed_targets,
                     &s3_push_ok,
-                    Some(&run.local_note),
+                    1,
+                    Some(&fresh.local_note),
                 )
                 .await
             {
@@ -11568,7 +11627,17 @@ impl<A: AdapterPort + 'static> HostingService<A> {
                 Err(e) => tracing::warn!(error = %e,
                     "backfill: could not list sites with off-site copies still on disk"),
             }
-            let keep = read_local_copy_policy(self.agent_config_path.as_deref()).keep_latest;
+            let policy = read_local_copy_policy(self.agent_config_path.as_deref());
+            let keep = policy.keep_latest;
+            if policy.keep_unreadable {
+                // "Keep none" is the most aggressive reading of a typo; refuse
+                // to drop anything until the file says what it means.
+                sites.clear();
+                out.note = "No local copy was deleted: [backup] keep_local_latest in this node's \
+                            agent.toml is not a whole number — fix it (Settings → Backups & trash \
+                            → Local backup copies) and run this again."
+                    .into();
+            }
             let targets: Vec<&hyperion_types::S3BackupTarget> = s3_targets.iter().collect();
             for h in sites {
                 let Ok(detail) = self.get(HostingSelector::Id(h)).await else {
@@ -11668,10 +11737,8 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             // push below is the fallback and reports for itself.
             if drop_local && run.offsite_on_record() && run.archive_path.is_some() {
                 let targets: Vec<&hyperion_types::S3BackupTarget> = s3_targets.iter().collect();
-                let evidence: std::collections::HashSet<String> =
-                    run.s3_ok_targets.iter().cloned().collect();
                 match self
-                    .drop_run_local_if_offsite(&detail, &run, &targets, &evidence, None)
+                    .drop_run_local_if_offsite(&detail, run.id, &targets, None)
                     .await
                 {
                     DropLocalOutcome::Dropped => {
@@ -29086,8 +29153,16 @@ impl<A: AdapterPort + 'static> HostingService<A> {
             });
         }
         // The archive (and its dump beside it) is in use until this returns:
-        // the drop-local sweep and the retention prune leave it alone.
-        let _busy = ArchiveInUse::claim(&canonical);
+        // the drop-local sweep and the retention prune leave it alone. If a
+        // drop is deleting it at this very moment, refuse rather than extract
+        // a file that is going away — it was verified off-site first.
+        let Some(_busy) = ArchiveInUse::try_claim(&canonical) else {
+            return Err(RpcError::Validation {
+                message: "this backup is being removed from local disk right now (it is verified \
+                          off-site) — restore it from the site's Off-site panel instead"
+                    .into(),
+            });
+        };
         // Where the dump is, and whether it is there NOW — before minutes of
         // extraction. A dump that was here at the start and is gone by the
         // database step is a restore that would put back the files of one
@@ -35067,6 +35142,11 @@ pub(crate) struct LocalCopyPolicy {
     /// `keep_local_latest` — 0 drops every local copy that is verified
     /// off-site, which is what the option meant before this knob existed.
     pub keep_latest: usize,
+    /// `keep_local_latest` is there but does not read as a whole number >= 0.
+    /// Nothing may drop local copies then — not the per-backup step (`drop`
+    /// is forced off) and not an on-demand sweep that would otherwise read
+    /// `keep_latest` 0 as "keep none".
+    pub keep_unreadable: bool,
 }
 
 /// `[backup]` as it is ON DISK, defaulting to "keep every local copy".
@@ -35099,11 +35179,18 @@ pub(crate) fn read_local_copy_policy(cfg_path: Option<&std::path::Path>) -> Loca
                         "[backup] keep_local_latest is not a whole number >= 0 — \
                          not dropping any local backup copy until it is fixed");
                 }
-                return LocalCopyPolicy::default();
+                return LocalCopyPolicy {
+                    keep_unreadable: true,
+                    ..LocalCopyPolicy::default()
+                };
             }
         },
     };
-    LocalCopyPolicy { drop, keep_latest }
+    LocalCopyPolicy {
+        drop,
+        keep_latest,
+        keep_unreadable: false,
+    }
 }
 
 /// Parse agent.toml once, for the readers above.
@@ -36478,6 +36565,9 @@ fn local_kept_reason(
     // there is — including an on-demand "Off-site & drop" on a node where the
     // automatic option is off, or on one of the newest copies. The note is
     // cleared with the local paths, so it exists only while the copy does.
+    if r.local_note == LOCAL_FILES_MISSING_NOTE {
+        return ("missing", r.local_note.clone());
+    }
     if !r.local_note.is_empty() {
         return ("unconfirmed", r.local_note.clone());
     }
@@ -36531,6 +36621,22 @@ fn local_kept_unconfirmed_note(unconfirmed: &[&str]) -> String {
     )
 }
 
+/// The note on a run whose local files are not on disk although its row
+/// lists them — nothing deleted, row left as it is (an unmounted backup volume
+/// looks exactly like this). Shown as its own kind on the Backups card.
+const LOCAL_FILES_MISSING_NOTE: &str =
+    "The local files of this backup are not on disk, although it is listed here (removed outside \
+     the panel, or the backup volume is not mounted). Nothing was deleted; retention retires the \
+     entry as usual.";
+
+/// curl exit codes that mean the FTP/SFTP server was reached and logged into,
+/// and ANSWERED "no" about this path: no such directory (9), could not access
+/// the file (19), a command was refused (21), no such file (78). Unlike a
+/// transport failure, another file on the same server may still be there.
+fn ftp_said_no(curl_exit: i32) -> bool {
+    matches!(curl_exit, 9 | 19 | 21 | 78)
+}
+
 /// The `.manifest.json` written beside a backup archive:
 /// `<domain>-<ts>.tar.gz` → `<domain>-<ts>.manifest.json`, same directory.
 /// `None` for a path that is not a `.tar.gz` — never guess at a sibling.
@@ -36636,14 +36742,24 @@ enum OffsiteCheck {
 
 /// Backup archives some operation on THIS node is using right now — a
 /// restore reading one, a backup writing and pushing its own, an on-demand
-/// push sending one — counted, because two operations can hold the same file.
-/// The drop-local sweep and the retention prune leave a busy archive alone:
-/// deleting it under a restore lets `tar` finish from its open handle and then
-/// finds the database dump gone, so the restore "succeeds" with the files of
-/// one moment and the database of another. In-process is enough: only the
+/// push sending one — counted, because two operations can hold the same file;
+/// and the ones a drop is deleting right now.
+///
+/// The two sides exclude each other ATOMICALLY, under this one mutex: a drop
+/// reserves an archive only while nobody else holds it (`try_reserve_drop`),
+/// and nobody new can take it while the reservation stands
+/// (`ArchiveInUse::try_claim`). Deleting an archive under a restore lets `tar`
+/// finish from its open handle and then finds the database dump gone — files
+/// of one moment over the database of another. In-process is enough: only the
 /// agent that owns the files ever deletes them.
-fn archives_in_use() -> &'static std::sync::Mutex<HashMap<std::path::PathBuf, usize>> {
-    static IN_USE: std::sync::OnceLock<std::sync::Mutex<HashMap<std::path::PathBuf, usize>>> =
+#[derive(Default)]
+struct ArchiveUse {
+    claims: usize,
+    dropping: bool,
+}
+
+fn archives_in_use() -> &'static std::sync::Mutex<HashMap<std::path::PathBuf, ArchiveUse>> {
+    static IN_USE: std::sync::OnceLock<std::sync::Mutex<HashMap<std::path::PathBuf, ArchiveUse>>> =
         std::sync::OnceLock::new();
     IN_USE.get_or_init(|| std::sync::Mutex::new(HashMap::new()))
 }
@@ -36661,14 +36777,15 @@ fn archive_use_key(p: &std::path::Path) -> std::path::PathBuf {
     }
 }
 
-/// Is some operation on this node using this archive right now?
+/// Is some operation on this node using (or dropping) this archive right
+/// now? A cheap pre-filter; the decision that counts is `try_reserve_drop`.
 fn archive_in_use(p: &std::path::Path) -> bool {
     let key = archive_use_key(p);
     archives_in_use()
         .lock()
         .unwrap_or_else(|e| e.into_inner())
         .get(&key)
-        .is_some_and(|n| *n > 0)
+        .is_some_and(|u| u.claims > 0 || u.dropping)
 }
 
 /// Holds an archive as in use until dropped — on every exit path, so an early
@@ -36676,29 +36793,103 @@ fn archive_in_use(p: &std::path::Path) -> bool {
 struct ArchiveInUse(std::path::PathBuf);
 
 impl ArchiveInUse {
+    /// Claim an archive nobody can be dropping: one this backup is about to
+    /// write.
     fn claim(p: &std::path::Path) -> Self {
         let key = archive_use_key(p);
-        *archives_in_use()
+        archives_in_use()
             .lock()
             .unwrap_or_else(|e| e.into_inner())
             .entry(key.clone())
-            .or_insert(0) += 1;
+            .or_default()
+            .claims += 1;
         ArchiveInUse(key)
     }
+
+    /// Claim an existing archive, unless a drop is deleting it right now.
+    fn try_claim(p: &std::path::Path) -> Option<Self> {
+        let key = archive_use_key(p);
+        let mut map = archives_in_use().lock().unwrap_or_else(|e| e.into_inner());
+        let u = map.entry(key.clone()).or_default();
+        if u.dropping {
+            return None;
+        }
+        u.claims += 1;
+        Some(ArchiveInUse(key))
+    }
 }
 
 impl Drop for ArchiveInUse {
     fn drop(&mut self) {
         let mut map = archives_in_use().lock().unwrap_or_else(|e| e.into_inner());
-        if let Some(n) = map.get_mut(&self.0) {
-            *n = n.saturating_sub(1);
-            if *n == 0 {
+        if let Some(u) = map.get_mut(&self.0) {
+            u.claims = u.claims.saturating_sub(1);
+            if u.claims == 0 && !u.dropping {
                 map.remove(&self.0);
             }
         }
     }
 }
 
+/// A drop's hold on an archive while it clears the row and deletes the files.
+struct DropReservation(std::path::PathBuf);
+
+/// Reserve an archive for deletion — only if nobody but the caller holds it
+/// (`own_claims`: 1 when the caller itself pushed it under a claim, else 0)
+/// and no other drop has it. While the reservation stands, `try_claim` fails,
+/// so a restore or push cannot start on a file being deleted.
+fn try_reserve_drop(p: &std::path::Path, own_claims: usize) -> Option<DropReservation> {
+    let key = archive_use_key(p);
+    let mut map = archives_in_use().lock().unwrap_or_else(|e| e.into_inner());
+    let u = map.entry(key.clone()).or_default();
+    if u.dropping || u.claims > own_claims {
+        if u.claims == 0 && !u.dropping {
+            map.remove(&key);
+        }
+        return None;
+    }
+    u.dropping = true;
+    Some(DropReservation(key))
+}
+
+impl Drop for DropReservation {
+    fn drop(&mut self) {
+        let mut map = archives_in_use().lock().unwrap_or_else(|e| e.into_inner());
+        if let Some(u) = map.get_mut(&self.0) {
+            u.dropping = false;
+            if u.claims == 0 {
+                map.remove(&self.0);
+            }
+        }
+    }
+}
+
+/// How a completed S3 push is recorded on a run: the target's name plus a
+/// short fingerprint of WHERE and HOW it wrote — endpoint, bucket, age
+/// recipient. Evidence earned against one configuration must not vouch for
+/// another: an operator who edits a target in place to a new age recipient
+/// (because the old identity was lost) has made every older ciphertext
+/// undecryptable, and a name-only record would still let those objects
+/// "confirm" a copy by existence and get the last readable copy deleted.
+fn s3_evidence_key(t: &hyperion_types::S3BackupTarget) -> String {
+    let mut h = blake3::Hasher::new();
+    for part in [
+        t.endpoint.trim(),
+        t.bucket.trim(),
+        t.age_recipient.as_deref().map(str::trim).unwrap_or(""),
+    ] {
+        h.update(part.as_bytes());
+        h.update(&[0]);
+    }
+    let hex = h.finalize().to_hex();
+    format!("{}#{}", t.name, &hex[..16])
+}
+
+/// The target name part of an evidence key (`name#fingerprint`).
+fn s3_evidence_name(key: &str) -> &str {
+    key.rsplit_once('#').map(|(n, _)| n).unwrap_or(key)
+}
+
 /// Per-run result of `push_run_offsite`, folded into an `OffsiteBackfillResult`
 /// by both the estate-wide backfill and the per-hosting push-drop. Exactly one
 /// of `pushed`/`failed`/`missing_locally` is set, plus at most one of
@@ -38694,6 +38885,81 @@ mod tests {
         assert_eq!(local_copies_to_drop(&rows, 1, &none), vec![3, 4]);
     }
 
+    /// A drop and a restore/push exclude each other atomically: no
+    /// reservation while someone else holds the archive, and no new hold
+    /// while a drop has it.
+    #[test]
+    fn drop_reservation_and_claims_exclude_each_other() {
+        use super::{try_reserve_drop, ArchiveInUse};
+        let dir = tempfile::tempdir().expect("dir");
+        let p = dir.path().join("y.cz-1.tar.gz");
+        std::fs::write(&p, b"x").expect("w");
+
+        let restore = ArchiveInUse::try_claim(&p).expect("free");
+        assert!(try_reserve_drop(&p, 0).is_none(), "a restore holds it");
+        // A caller that holds ONE claim itself (a push about to drop what it
+        // just sent) may reserve only if nobody else holds it too.
+        let push = ArchiveInUse::try_claim(&p).expect("free");
+        assert!(
+            try_reserve_drop(&p, 1).is_none(),
+            "restore + push = 2 holders"
+        );
+        drop(restore);
+        let r = try_reserve_drop(&p, 1).expect("only the pusher holds it");
+        // While reserved, nobody new can start on it.
+        assert!(ArchiveInUse::try_claim(&p).is_none());
+        assert!(try_reserve_drop(&p, 1).is_none(), "one drop at a time");
+        drop(r);
+        drop(push);
+        assert!(ArchiveInUse::try_claim(&p).is_some());
+        assert!(try_reserve_drop(&p, 0).is_some());
+    }
+
+    /// S3 evidence is tied to the target configuration it was earned
+    /// against: a new age recipient (or bucket/endpoint) makes old evidence
+    /// inert.
+    #[test]
+    fn s3_evidence_key_tracks_the_target_configuration() {
+        use super::{s3_evidence_key, s3_evidence_name};
+        let t = |rcpt: Option<&str>, bucket: &str| hyperion_types::S3BackupTarget {
+            name: "vault".into(),
+            endpoint: "https://s3.example".into(),
+            bucket: bucket.into(),
+            region: "eu".into(),
+            access_key_id: "k".into(),
+            secret_access_key: "s".into(),
+            age_recipient: rcpt.map(Into::into),
+            retention_daily: 0,
+        };
+        let a = s3_evidence_key(&t(Some("age1aaa"), "b"));
+        assert_eq!(
+            a,
+            s3_evidence_key(&t(Some(" age1aaa "), "b")),
+            "trimmed, stable"
+        );
+        assert_ne!(
+            a,
+            s3_evidence_key(&t(Some("age1bbb"), "b")),
+            "new recipient"
+        );
+        assert_ne!(a, s3_evidence_key(&t(Some("age1aaa"), "c")), "new bucket");
+        assert_ne!(a, s3_evidence_key(&t(None, "b")), "encryption switched off");
+        assert_eq!(s3_evidence_name(&a), "vault");
+        assert_eq!(s3_evidence_name("plain"), "plain");
+    }
+
+    #[test]
+    fn ftp_said_no_is_an_answer_transport_errors_are_not() {
+        use super::ftp_said_no;
+        for c in [9, 19, 21, 78] {
+            assert!(ftp_said_no(c), "{c}");
+        }
+        // refused, resolve, timeout, TLS, login denied: could not look.
+        for c in [6, 7, 28, 35, 67] {
+            assert!(!ftp_said_no(c), "{c}");
+        }
+    }
+
     /// The busy-archive registry counts: two holders of one archive keep it
     /// busy until BOTH let go, and a key taken before the file exists matches
     /// the path spelled the same way afterwards.
@@ -38724,14 +38990,17 @@ mod tests {
         let off = LocalCopyPolicy {
             drop: false,
             keep_latest: 0,
+            ..LocalCopyPolicy::default()
         };
         let on = LocalCopyPolicy {
             drop: true,
             keep_latest: 0,
+            ..LocalCopyPolicy::default()
         };
         let on_keep2 = LocalCopyPolicy {
             drop: true,
             keep_latest: 2,
+            ..LocalCopyPolicy::default()
         };
         let verified = bk_run(1, "ok", true, "verified", false);
         let uploaded = bk_run(1, "ok", true, "ok", false);
@@ -38783,6 +39052,11 @@ mod tests {
             "unconfirmed"
         );
         assert_eq!(local_kept_reason(&local_only, on, Some(3)).0, "");
+        // Files listed but not on disk: its own kind, whatever the policy.
+        let mut missing = verified.clone();
+        missing.local_note = super::LOCAL_FILES_MISSING_NOTE.into();
+        assert_eq!(local_kept_reason(&missing, off, Some(0)).0, "missing");
+        assert_eq!(local_kept_reason(&missing, on, Some(5)).0, "missing");
         // An S3-only backup with a completed push is on record too.
         let mut s3_only = local_only.clone();
         s3_only.s3_ok_targets = vec!["vault".into()];
@@ -38876,7 +39150,8 @@ mod tests {
             read_local_copy_policy(Some(&cfg)),
             LocalCopyPolicy {
                 drop: true,
-                keep_latest: 2
+                keep_latest: 2,
+                keep_unreadable: false,
             }
         );
 
@@ -38892,10 +39167,7 @@ mod tests {
             "[backup]\ndrop_local_after_offsite = \"true\"\nkeep_local_latest = -5\n",
         )
         .expect("write");
-        assert_eq!(
-            read_local_copy_policy(Some(&cfg)),
-            LocalCopyPolicy::default()
-        );
+        assert!(!read_local_copy_policy(Some(&cfg)).drop);
         // …and a keep count that does not read as a whole number turns
         // dropping OFF — never into "keep 0", the most aggressive setting.
         for bad in ["\"3\"", "3.0", "-5", "true"] {
@@ -38904,11 +39176,9 @@ mod tests {
                 format!("[backup]\ndrop_local_after_offsite = true\nkeep_local_latest = {bad}\n"),
             )
             .expect("write");
-            assert_eq!(
-                read_local_copy_policy(Some(&cfg)),
-                LocalCopyPolicy::default(),
-                "keep_local_latest = {bad}"
-            );
+            let p = read_local_copy_policy(Some(&cfg));
+            assert!(!p.drop, "keep_local_latest = {bad}");
+            assert!(p.keep_unreadable, "keep_local_latest = {bad}");
         }
         // Too large is clamped down, which keeps more.
         std::fs::write(
@@ -38920,7 +39190,8 @@ mod tests {
             read_local_copy_policy(Some(&cfg)),
             LocalCopyPolicy {
                 drop: true,
-                keep_latest: 1000
+                keep_latest: 1000,
+                keep_unreadable: false,
             }
         );
     }
@@ -39126,6 +39397,68 @@ mod tests {
         assert_eq!(audit_fails(pool.clone()).await, 1);
     }
 
+    /// A stored "could not confirm" goes once the copy is kept on purpose
+    /// (inside the keep window), and an unreadable keep count stops the
+    /// estate sweep from dropping anything — it never reads as "keep 0".
+    #[tokio::test]
+    async fn stale_notes_clear_and_unreadable_keep_blocks_the_sweep() {
+        use hyperion_state::backups;
+        let pool = open_memory().await.expect("open");
+        let mut s = svc(pool.clone(), happy_mocks());
+        s.remote_backup = Some(RemoteBackupConfig {
+            scheme: "ftp".into(),
+            host: "127.0.0.1".into(),
+            port: 1,
+            user: "u".into(),
+            password: "p".into(),
+            base_path: "/backups".into(),
+        });
+        let dir = tempfile::tempdir().expect("dir");
+        let cfg = dir.path().join("agent.toml");
+        std::fs::write(
+            &cfg,
+            "[backup]\ndrop_local_after_offsite = true\nkeep_local_latest = \"3\"\n",
+        )
+        .expect("cfg");
+        s.agent_config_path = Some(cfg);
+        s.create(req("stale.cz")).await.expect("create");
+        let detail = s
+            .get(HostingSelector::Domain(Domain::parse("stale.cz").unwrap()))
+            .await
+            .expect("get");
+        let archive = dir.path().join("stale.cz-100.tar.gz");
+        std::fs::write(&archive, b"x").expect("w");
+        let run = backups::start(&pool, &detail.id, "local", 100)
+            .await
+            .expect("start");
+        backups::mark_ok(&pool, run, &archive.display().to_string(), None, 1, 101)
+            .await
+            .expect("ok");
+        backups::set_remote(&pool, run, "ftp://x/y", "verified", "")
+            .await
+            .expect("remote");
+        backups::set_local_note(&pool, run, "Kept on this node: old news")
+            .await
+            .expect("note");
+
+        // Unreadable keep count → the estate sweep drops nothing and says why.
+        let r = s
+            .backup_offsite_backfill(10, true, vec![])
+            .await
+            .expect("backfill");
+        assert_eq!((r.dropped, r.kept_local), (0, 0));
+        assert!(r.note.contains("keep_local_latest"), "{}", r.note);
+        assert!(archive.exists());
+
+        // Inside the keep window (keep 1, it is the newest) → not a candidate,
+        // so its old warning is cleared.
+        let empty = std::collections::HashMap::new();
+        let out = s.enforce_local_copies(&detail, 1, &[], &empty).await;
+        assert!(out.is_empty());
+        let row = backups::get_by_id(&pool, run).await.unwrap().unwrap();
+        assert_eq!(row.local_note, "");
+    }
+
     /// The other ways a candidate is NOT a kept copy, against a destination
     /// that cannot be reached (so nothing could ever be confirmed — whatever
     /// happens here happens without an off-site answer):
@@ -39204,11 +39537,17 @@ mod tests {
         let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
         assert_eq!(out, vec![(gone, DropLocalOutcome::MissingLocally)]);
         let row = backups::get_by_id(&pool, gone).await.unwrap().unwrap();
-        assert_eq!((row.archive_path, row.db_dump_path), (None, None));
+        // Absence alone is not proof (an unmounted volume looks the same):
+        // the row keeps its paths and says so.
+        assert!(row.archive_path.is_some() && row.db_dump_path.is_some());
+        assert_eq!(row.local_note, super::LOCAL_FILES_MISSING_NOTE);
         assert_eq!(
             row.remote_state, "verified",
             "the off-site record is untouched"
         );
+        let list = s.backup_list(sel.clone(), 10).await.expect("list");
+        let b = list.iter().find(|b| b.id == gone).expect("row");
+        assert_eq!(b.local_kept, "missing");
 
         // Dump only: archive gone, dump still on disk → the dump is checked.
         let dump = dir.path().join("odd.cz-100.sql");
@@ -39220,7 +39559,13 @@ mod tests {
         )
         .await;
         let out = s.enforce_local_copies(&detail, 0, &[], &empty).await;
-        assert_eq!(out, vec![(half, DropLocalOutcome::Unreachable)]);
+        assert_eq!(
+            out,
+            vec![
+                (gone, DropLocalOutcome::MissingLocally),
+                (half, DropLocalOutcome::Unreachable)
+            ]
+        );
         assert!(dump.exists());
         let row = backups::get_by_id(&pool, half).await.unwrap().unwrap();
         assert!(
diff --git a/crates/hyperion-state/src/backups.rs b/crates/hyperion-state/src/backups.rs
index da32f9cb..8077e2fe 100644
--- a/crates/hyperion-state/src/backups.rs
+++ b/crates/hyperion-state/src/backups.rs
@@ -300,7 +300,8 @@ pub async fn mark_no_offsite(pool: &SqlitePool, id: i64) -> Result<(), StateErro
     Ok(())
 }
 
-/// Successful local backups with no off-site copy, oldest first.
+/// Successful local backups with no off-site copy on record (no FTP `ok` /
+/// `verified`, no completed S3 push), oldest first.
 ///
 /// What a backfill works from. `state='ok'` because pushing the archive of a
 /// failed run would copy a file that may be truncated; oldest first because
@@ -315,6 +316,7 @@ pub async fn list_needing_offsite(
             AND archive_path IS NOT NULL \
             AND no_offsite = 0 \
             AND (remote_state IS NULL OR remote_state NOT IN ('ok', 'verified')) \
+            AND (s3_ok_targets IS NULL OR s3_ok_targets IN ('', '[]')) \
           ORDER BY started_at ASC \
           LIMIT ?"
     ))
@@ -735,6 +737,26 @@ mod tests {
         let r = get_by_id(&pool, run).await.unwrap().unwrap();
         assert_eq!(r.s3_ok_targets.len(), 2);
 
+        // A completed S3 push means "off-site on record": not a backfill
+        // candidate any more (it used to be re-uploaded by every backfill).
+        let fresh = start(&pool, &id, "local", 200).await.expect("start2");
+        mark_ok(&pool, fresh, "/b/f.tar.gz", None, 1, 210)
+            .await
+            .expect("ok2");
+        assert!(list_needing_offsite(&pool, 10)
+            .await
+            .unwrap()
+            .iter()
+            .any(|r| r.id == fresh));
+        set_s3_ok_targets(&pool, fresh, &["vault#ab".into()])
+            .await
+            .expect("set2");
+        assert!(!list_needing_offsite(&pool, 10)
+            .await
+            .unwrap()
+            .iter()
+            .any(|r| r.id == fresh));
+
         set_s3_ok_targets(&pool, run, &[]).await.expect("empty");
         assert!(get_by_id(&pool, run)
             .await
diff --git a/crates/hyperion-types/src/limits.rs b/crates/hyperion-types/src/limits.rs
index 15ec5658..7807ed71 100644
--- a/crates/hyperion-types/src/limits.rs
+++ b/crates/hyperion-types/src/limits.rs
@@ -279,8 +279,11 @@ pub struct BackupRunWire {
     ///     off-site" is off on the node that owns the site;
     ///   * `"keep_newest"` — the option is on, but this is one of the newest
     ///     local copies the node is set to keep;
-    ///   * `"unconfirmed"` — the option is on, but the drop step could not
-    ///     confirm every file off-site, so it kept the copy.
+    ///   * `"unconfirmed"` — a drop step could not confirm every file
+    ///     off-site, so it kept the copy;
+    ///   * `"pending"` — the option is on and this copy goes at the site's
+    ///     next archive backup;
+    ///   * `"missing"` — the row lists local files that are not on disk.
     #[serde(default)]
     pub local_kept: String,
     /// The same, in words, for a tooltip/sub-line. Empty when `local_kept` is.
@@ -311,6 +314,16 @@ impl BackupRunWire {
         }
     }
 
+    /// The S3 target names of `s3_ok_targets`, without the configuration
+    /// fingerprint each is recorded with, for display.
+    pub fn s3_target_names(&self) -> String {
+        self.s3_ok_targets
+            .iter()
+            .map(|k| k.rsplit_once('#').map(|(n, _)| n).unwrap_or(k))
+            .collect::<Vec<_>>()
+            .join(", ")
+    }
+
     /// A few words under the off-site pill for why the LOCAL copy is still on
     /// disk (see `local_kept`); the full reason goes in its tooltip. Empty when
     /// there is nothing to explain.
@@ -320,6 +333,7 @@ impl BackupRunWire {
             "keep_newest" => "kept locally (newest)",
             "unconfirmed" => "local kept: not confirmed off-site",
             "pending" => "local copy: drops at next backup",
+            "missing" => "local files not on disk",
             _ => "",
         }
     }
@@ -467,6 +481,11 @@ pub struct OffsiteBackfillResult {
     /// again. Lets the job log say why `pushed` is lower than `dropped`.
     #[serde(default)]
     pub already_offsite: i64,
+    /// Something the operator must know about the run as a whole (e.g. the
+    /// drop phase was skipped because the keep count is unreadable). Empty =
+    /// nothing.
+    #[serde(default)]
+    pub note: String,
 }
 
 /// One IP ban as shown in the UI / returned over the wire.