feat(admin): say how long dumps keep deleted accounts, and check the bucket rule for database/

A database dump is the whole database at one moment, so an account deleted
since stays in the dumps taken before until they age out. The database row
on the backups card now says so with the numbers that decide it: how many
nightly dumps this server keeps, and after how many days the bucket's
lifecycle rule removes the off-host copies.

The lifecycle probe used to answer with the shortest expiry of any enabled
rule, whatever its prefix, so a rule scoped to the account copies read as
covering the dumps too. It now also answers for `database/` alone, counting
only rules whose filter takes in a dump's key (prefix, legacy prefix, an
And filter; a tag filter never matches untagged objects), and the card
warns when no rule covers that prefix: dumps there, and the deleted accounts
in them, would never be removed. The reading moved into its own module.

src/components/admin/__tests__/offhost-backups-section.test.tsx

@@ -26,7 +26,11 @@ import { OffhostBackupsSection } from "../offhost-backups-section";
 const QUIET = {
   activity: { runningSince: null, interrupted: [] },
   pendingDeletions: { count: 0, oldestRequestedAt: null, lastFailure: null },
-  lifecycle: { state: "configured" as const, expirationDays: 30 },
+  lifecycle: {
+    state: "configured" as const,
+    expirationDays: 30,
+    database: { state: "configured" as const, expirationDays: 30 },
+  },
 };
 
 function render(data: BackupsList["offhost"] | null): string {
@@ -133,7 +137,11 @@ describe("<OffhostBackupsSection>", () => {
         oldestRequestedAt: "2026-09-20T10:00:00.000Z",
         lastFailure: "AccessDenied",
       },
-      lifecycle: { state: "missing", expirationDays: null },
+      lifecycle: {
+        state: "missing",
+        expirationDays: null,
+        database: { state: "missing", expirationDays: null },
+      },
     });
     expect(html).toContain('data-lifecycle-state="missing"');
     expect(html).toContain("no lifecycle rule");

src/components/admin/backups-section.tsx

@@ -111,7 +111,14 @@ export function BackupsSection() {
         }
       />
 
-      {data?.database ? <DatabaseDumpRow health={data.database} /> : null}
+      {data?.database ? (
+        <DatabaseDumpRow
+          health={data.database}
+          bucketLifecycle={
+            data.offhost.configured ? data.offhost.lifecycle.database : null
+          }
+        />
+      ) : null}
       {data?.schedule ? (
         <ScheduleHealthNotice schedule={data.schedule} />
       ) : null}

src/components/admin/backups/__tests__/database-dump-row.test.tsx

@@ -0,0 +1,93 @@
+/**
+ * The database row on the backups card says where the newest good dump is,
+ * how long a deleted account stays in the dumps, and each thing that keeps a
+ * dump from being taken or from ever ageing out of the bucket.
+ */
+import { describe, expect, it } from "vitest";
+import { renderToStaticMarkup } from "react-dom/server";
+
+import { I18nProvider } from "@/lib/i18n/context";
+import type { DatabaseBackupHealth } from "@/lib/database-backup/health";
+import type { LifecycleVerdict } from "@/lib/jobs/offhost-lifecycle";
+
+import { DatabaseDumpRow } from "../database-dump-row";
+
+const HEALTHY: DatabaseBackupHealth = {
+  enabled: true,
+  directory: "/var/lib/healthlog/backups",
+  keepNightly: 7,
+  localDirWritable: true,
+  offhostConfigured: true,
+  lastGood: {
+    at: "2026-10-24T23:31:00.000Z",
+    fileName: "healthlog-20261024T233000Z-daily.dump",
+    sizeBytes: 52_428_800,
+    local: true,
+    offhost: true,
+  },
+  lastFailure: null,
+};
+
+function render(
+  health: DatabaseBackupHealth,
+  bucketLifecycle: LifecycleVerdict | null = {
+    state: "configured",
+    expirationDays: 30,
+  },
+): string {
+  return renderToStaticMarkup(
+    <I18nProvider initialLocale="en">
+      <DatabaseDumpRow health={health} bucketLifecycle={bucketLifecycle} />
+    </I18nProvider>,
+  );
+}
+
+describe("<DatabaseDumpRow>", () => {
+  it("names the newest good dump, where it is, and how long dumps keep deleted accounts", () => {
+    const html = render(HEALTHY);
+    expect(html).toContain("kept on this server and off-host");
+    expect(html).toContain("the newest 7 are kept on this server");
+    expect(html).toContain("removed after 30 days");
+    expect(html).not.toContain('data-slot="database-dump-failed"');
+    expect(html).not.toContain('data-slot="database-dump-setup"');
+    expect(html).not.toContain('data-slot="database-dump-no-lifecycle"');
+  });
+
+  it("warns when no bucket rule ever removes the dumps", () => {
+    const html = render(HEALTHY, { state: "missing", expirationDays: null });
+    expect(html).toContain('data-slot="database-dump-no-lifecycle"');
+    expect(html).toContain("never removed");
+  });
+
+  it("shows a failure newer than the last good dump, and not an older one", () => {
+    const failed = render({
+      ...HEALTHY,
+      lastFailure: {
+        at: "2026-10-25T23:31:00.000Z",
+        error: "pg_dump exited 1: No space left on device",
+      },
+    });
+    expect(failed).toContain('data-slot="database-dump-failed"');
+    expect(failed).toContain("No space left on device");
+    const recovered = render({
+      ...HEALTHY,
+      lastFailure: { at: "2026-10-20T23:31:00.000Z", error: "old" },
+    });
+    expect(recovered).not.toContain('data-slot="database-dump-failed"');
+  });
+
+  it("says when dumps go off-host only, or cannot be taken at all", () => {
+    expect(render({ ...HEALTHY, localDirWritable: false }, null)).toContain(
+      "dumps go off-host only",
+    );
+    expect(
+      render(
+        { ...HEALTHY, localDirWritable: false, offhostConfigured: false },
+        null,
+      ),
+    ).toContain("no database dump can be taken");
+    expect(render({ ...HEALTHY, lastGood: null }, null)).toContain(
+      "No database dump yet",
+    );
+  });
+});

src/components/admin/backups/database-dump-row.tsx

@@ -14,6 +14,7 @@ import { SettingsInfoTile } from "@/components/settings/_info-tile";
 import { formatBytes } from "@/lib/format/bytes";
 import { useFormatters, useTranslations } from "@/lib/i18n/context";
 import type { DatabaseBackupHealth } from "@/lib/database-backup/health";
+import type { LifecycleVerdict } from "@/lib/jobs/offhost-lifecycle";
 
 function whereKept(
   good: NonNullable<DatabaseBackupHealth["lastGood"]>,
@@ -26,7 +27,14 @@ function whereKept(
   return t("admin.section.backups.database.whereLocal");
 }
 
-export function DatabaseDumpRow({ health }: { health: DatabaseBackupHealth }) {
+export function DatabaseDumpRow({
+  health,
+  bucketLifecycle,
+}: {
+  health: DatabaseBackupHealth;
+  /** The bucket's rule for `database/`; null when nothing goes off-host. */
+  bucketLifecycle: LifecycleVerdict | null;
+}) {
   const { t, locale } = useTranslations();
   const fmt = useFormatters();
   const good = health.lastGood;
@@ -70,6 +78,21 @@ export function DatabaseDumpRow({ health }: { health: DatabaseBackupHealth }) {
                 })
               : t("admin.section.backups.database.none")}
           </p>
+          {/* How long a deleted account stays in the dumps: the operator's
+              side of the deletion promise (GDPR retention of backups). */}
+          <p
+            className="text-muted-foreground text-xs"
+            data-slot="database-dump-retention"
+          >
+            {t("admin.section.backups.database.retentionLocal", {
+              nights: health.keepNightly,
+            })}
+            {bucketLifecycle?.state === "configured"
+              ? ` ${t("admin.section.backups.database.retentionOffhost", {
+                  days: bucketLifecycle.expirationDays ?? 0,
+                })}`
+              : null}
+          </p>
         </div>
       </div>
 
@@ -99,6 +122,17 @@ export function DatabaseDumpRow({ health }: { health: DatabaseBackupHealth }) {
         </div>
       ) : null}
 
+      {bucketLifecycle?.state === "missing" ? (
+        <SettingsInfoTile
+          icon={AlertTriangle}
+          tone="warning"
+          role="alert"
+          data-slot="database-dump-no-lifecycle"
+        >
+          {t("admin.section.backups.database.retentionOffhostMissing")}
+        </SettingsInfoTile>
+      ) : null}
+
       {setupProblem ? (
         <SettingsInfoTile
           icon={AlertTriangle}