deploy/env/prod.env.example

@@ -147,3 +147,7 @@ MFILES_USERNAME=mfileskitRO
 MFILES_CA_BUNDLE=/etc/ssl/pesco/ca.pem
 
 # PS_BUILD is baked into the image at build time. Do not set it here.
+
+# Archive root (Gitea issue 7). The QNAP NFS share, mounted at this fixed path and writable by uid 10001.
+# Unset or blank turns the archive off. The archive folder itself is chosen under Admin, Storage, File locations.
+ARCHIVE_ROOT=

deploy/env/test.env.example

@@ -147,3 +147,7 @@ MFILES_USERNAME=mfileskitRO
 MFILES_CA_BUNDLE=/etc/ssl/pesco/ca.pem
 
 # PS_BUILD is baked into the image at build time. Do not set it here.
+
+# Archive root (Gitea issue 7). The QNAP NFS share, mounted at this fixed path and writable by uid 10001.
+# Unset or blank turns the archive off. The archive folder itself is chosen under Admin, Storage, File locations.
+ARCHIVE_ROOT=

docs/PLAN.md

@@ -291,6 +291,7 @@ From phase 9 (2026-10-21), for Seth or Spencer to veto:
 50. The profile CSV `stations` cell: default the cell is the person's whole list of station limits across departments and replaces every limit they had; `-` clears them all; an empty cell leaves them. Phase 9 (2026-10-21) applied the default.
 51. A direct welder assign: default it does not check `profile_active`, so an Admin's inactive switch hides a person from the picker but a typed assign still works. Phase 9 (2026-10-21) applied the default; say if an inactive profile should be refused there too.
 52. A checklist item added while a stage is open: default it applies to that open stage too, because completeness reads the live template, so the item must be ticked before submit. Phase 9 (2026-10-21) applied the default. Replaced by change C8: a template change applies to new packets only. Built on 2026-10-30: a stage freezes its list at START, so a change reaches only stages not yet started.
+53. A failed archive copy at filing (phase 10, Gitea issue 7): default it never blocks the filing. The FILE transaction asks the worker for an `archive-copy` run; the job retries a failed copy after 5, 15 and 60 minutes, then hourly, and raises the `archive_failed` condition to Admin after 3 failed tries or a failed folder check. Admin, Storage, File locations shows the failures and has "Retry now". Turning the archive on later also copies the earlier filings. Seth or Spencer may ask for the stricter rule (the copy must succeed before the packet counts as filed) instead.
 
 Changes decided by SethD on 2026-10-26. Each replaces a default above. All five were built on 2026-10-30 (branch `seth-changes`):
 

docs/POLICY.md

@@ -891,6 +891,10 @@ Every endpoint under `/api/admin` needs an Admin (PS-Admins) in a password sessi
 | `POST /users/import` | The profile CSV, as a preview (`apply: false`) or applied | `admin.profile_updated` per changed person, `admin.profile_import` |
 | `GET /checklists`, `PUT /checklists` | The default weld and plain lists, used by a department without its own list (see "Checklists"). The Admin screen no longer calls these; its Checklists tab edits department lists. | `admin.checklists_updated` |
 | `GET /security/settings`, `PUT /security/settings` | The session, lock and sign-in limit settings | `admin.security_settings_updated` |
+| `GET /file-locations` | The archive root, the saved archive folder, the last check and the copy counts | none |
+| `POST /file-locations/check` | Check a candidate archive folder: write, read back and remove a probe file. Saves nothing | `archive.checked` |
+| `PUT /file-locations` | Save the archive folder after the same check. 409 `archive_off` while `ARCHIVE_ROOT` is unset | `admin.file_locations_updated` |
+| `POST /file-locations/retry` | Ask the worker for an `archive-copy` run now and make every failed copy due | `admin.archive_retry` |
 | `GET /security/alerts?hours=` | Security alerts for 1 to 168 hours | none |
 | `GET /security/integrity` | The newest finished integrity run and its findings | none |
 | `GET /access-log` | Sign-in attempts and identity audit rows for everyone | none |