M5: notifications, setup check, audit log and password confirmation

- notifications to administrators for failed backup/restore runs and
  locations without a successful backup for two days (once a day)
- setup check in the admin overview: error when the key/kit is not set
  up, warning for missing, old or failed backups
- security events (recovery kit downloaded, location removed,
  append-only turned off, retention changed, snapshots forgotten) go to
  the audit log and are announced to all administrators, from the web
  and from occ; the scheduled weekly cleanup is logged only
- fix: the recovery-kit download link failed the CSRF check (412); it
  now requires a recent password confirmation instead, like creating the
  key, removing a location and restoring

appinfo/info.xml

@@ -5,7 +5,7 @@
     <name>NG Backup</name>
     <summary>Encrypted, incremental backups of your Nextcloud with restore from the web interface</summary>
     <description><![CDATA[Work in progress, not ready for use.]]></description>
-    <version>0.0.5</version>
+    <version>0.0.8</version>
     <licence>agpl</licence>
     <author>Dillard Blom</author>
     <namespace>NgBackup</namespace>
@@ -32,6 +32,9 @@
         <command>OCA\NgBackup\Command\ListSnapshots</command>
         <command>OCA\NgBackup\Command\Browse</command>
         <command>OCA\NgBackup\Command\Restore</command>
+        <command>OCA\NgBackup\Command\Prune</command>
+        <command>OCA\NgBackup\Command\Retention</command>
+        <command>OCA\NgBackup\Command\TargetAppendOnly</command>
     </commands>
     <settings>
         <admin>OCA\NgBackup\Settings\Admin</admin>

lib/AppInfo/Application.php

@@ -20,6 +20,8 @@ class Application extends App implements IBootstrap {
 	}
 
 	public function register(IRegistrationContext $context): void {
+		$context->registerNotifierService(\OCA\NgBackup\Notification\Notifier::class);
+		$context->registerSetupCheck(\OCA\NgBackup\SetupCheck\BackupStatusCheck::class);
 	}
 
 	public function boot(IBootContext $context): void {

lib/BackgroundJob/BackupJob.php

@@ -26,6 +26,8 @@ class BackupJob extends TimedJob {
 	public function __construct(
 		ITimeFactory $time,
 		private BackupService $backups,
+		private \OCA\NgBackup\Service\PruneService $prune,
+		private \OCA\NgBackup\Service\AlertService $alerts,
 		private TargetService $targets,
 		private RunMapper $runs,
 		private IAppConfig $appConfig,
@@ -45,6 +47,29 @@ class BackupJob extends TimedJob {
 				$run = $this->backups->step($run, min($deadline, microtime(true) + $budget));
 			}
 		}
+		$this->weeklyPrune();
+		foreach ($this->targets->list() as $t) {
+			$this->alerts->checkStale($t);
+		}
+	}
+
+	/** Once a week (after Sunday's backup), apply the retention policy to non-append-only locations. */
+	private function weeklyPrune(): void {
+		$lastWeek = $this->appConfig->getValueString(Application::APP_ID, 'last_prune_week', '');
+		if (date('N') !== '7' || $lastWeek === date('o-W') || $this->runs->findRunning(null, BackupService::KIND_FULL) !== []) {
+			return;
+		}
+		foreach ($this->targets->list() as $t) {
+			if ($t->getAppendOnly()) {
+				continue;
+			}
+			try {
+				$this->prune->apply($t, false, true);
+			} catch (\Throwable $e) {
+				$this->logger->warning('NG Backup: cleanup of ' . $t->getName() . ' failed: ' . $e->getMessage());
+			}
+		}
+		$this->appConfig->setValueString(Application::APP_ID, 'last_prune_week', date('o-W'));
 	}
 
 	/** Daily schedule: appconfig ng_backup/schedule_time "HH:MM" (server time); empty = no schedule. */

lib/BackgroundJob/RestoreJob.php

@@ -23,6 +23,7 @@ class RestoreJob extends QueuedJob {
 		private TargetService $targets,
 		private RestoreService $restore,
 		private LoggerInterface $logger,
+		private \OCA\NgBackup\Service\AlertService $alerts,
 	) {
 		parent::__construct($time);
 	}
@@ -46,6 +47,7 @@ class RestoreJob extends QueuedJob {
 			$this->logger->error('NG Backup restore ' . $run->getId() . ' failed: ' . $e->getMessage(), ['exception' => $e]);
 			$run->setStatus(Run::FAILED);
 			$run->setError($e->getMessage());
+			$this->alerts->runFailed($run, '#' . $run->getTargetId());
 		}
 		$run->setFinishedAt(time());
 		$run->setUpdatedAt(time());

lib/Command/KeyKit.php

@@ -16,6 +16,7 @@ use Symfony\Component\Console\Output\OutputInterface;
 class KeyKit extends Command {
 	public function __construct(
 		private KeyService $keys,
+		private \OCA\NgBackup\Service\AlertService $alerts,
 	) {
 		parent::__construct();
 	}
@@ -31,6 +32,7 @@ class KeyKit extends Command {
 			$output->writeln('<error>No backup key yet: run occ backup:key:init first.</error>');
 			return 1;
 		}
+		$this->alerts->securityEvent('kit_downloaded');
 		$json = json_encode($this->keys->recoveryKit(), JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR) . "\n";
 		$file = $input->getOption('output');
 		if ($file === null) {

lib/Command/Prune.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\PruneService;
+use OCA\NgBackup\Service\TargetService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class Prune extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private PruneService $prune,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:prune')
+			->setDescription('Apply the retention policy: remove old snapshots and the data only they used')
+			->addArgument('target', InputArgument::OPTIONAL, 'Location name or id (default: all that are not append-only)')
+			->addOption('dry-run', null, InputOption::VALUE_NONE, 'Only show what would be removed');
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$name = $input->getArgument('target');
+		$targets = $name === null ? array_filter($this->targets->list(), fn ($t) => !$t->getAppendOnly()) : [$this->targets->get($name)];
+		$dry = (bool)$input->getOption('dry-run');
+		$output->writeln('Policy: ' . json_encode($this->prune->policy()->toArray()) . ($dry ? ' (dry run)' : ''));
+		$rc = 0;
+		foreach ($targets as $t) {
+			try {
+				$r = $this->prune->apply($t, $dry);
+			} catch (\Throwable $e) {
+				$output->writeln('<error>' . $t->getName() . ': ' . $e->getMessage() . '</error>');
+				$rc = 1;
+				continue;
+			}
+			$p = $r['prune'];
+			$output->writeln(sprintf('<info>%s</info>: keep %d, %s %d snapshots; packs: %d, %s %d, repack %d, frees %.1f MiB',
+				$t->getName(), count($r['kept']), $dry ? 'would forget' : 'forgot', count($r['forgotten']), $p['packs'],
+				$dry ? 'would delete' : 'deleted', $p['deleted'], $p['repacked'], $p['freedBytes'] / 1048576));
+		}
+		return $rc;
+	}
+}

lib/Command/Retention.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\PruneService;
+use OCA\NgBackup\Service\RetentionPolicy;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class Retention extends Command {
+	public function __construct(
+		private PruneService $prune,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:retention')
+			->setDescription('Show or set how many snapshots are kept')
+			->addOption('last', null, InputOption::VALUE_REQUIRED, 'Always keep the newest N')
+			->addOption('daily', null, InputOption::VALUE_REQUIRED, 'Keep one per day for the last N days with a backup')
+			->addOption('weekly', null, InputOption::VALUE_REQUIRED, 'Keep one per week for N weeks')
+			->addOption('monthly', null, InputOption::VALUE_REQUIRED, 'Keep one per month for N months')
+			->setHelp("Example: occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12");
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$p = $this->prune->policy()->toArray();
+		$changed = false;
+		foreach (['last', 'daily', 'weekly', 'monthly'] as $k) {
+			if ($input->getOption($k) !== null) {
+				$p[$k] = max(0, (int)$input->getOption($k));
+				$changed = true;
+			}
+		}
+		if ($changed) {
+			try {
+				$this->prune->setPolicy(RetentionPolicy::fromArray($p));
+			} catch (\InvalidArgumentException $e) {
+				$output->writeln('<error>' . $e->getMessage() . '</error>');
+				return 1;
+			}
+		}
+		$output->writeln(sprintf('Keep the last %d, plus one per day for %d days, per week for %d weeks, per month for %d months.', $p['last'], $p['daily'], $p['weekly'], $p['monthly']));
+		return 0;
+	}
+}

lib/Command/TargetAppendOnly.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\TargetService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class TargetAppendOnly extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private \OCA\NgBackup\Service\AlertService $alerts,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:target:append-only')
+			->setDescription('Make a location append-only (NG Backup never deletes there) or normal again')
+			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
+			->addArgument('state', InputArgument::REQUIRED, 'on or off')
+			->setHelp("Append-only protects backups if this server is compromised: combine it with credentials\nwithout delete rights and a lifecycle rule or object lock on the location itself.");
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$state = strtolower((string)$input->getArgument('state'));
+		if (!in_array($state, ['on', 'off'], true)) {
+			$output->writeln('<error>state must be on or off</error>');
+			return 1;
+		}
+		$t = $this->targets->setAppendOnly($this->targets->get($input->getArgument('target')), $state === 'on');
+		if ($state === 'off') {
+			$this->alerts->securityEvent('append_only_off', ['target' => $t->getName()]);
+		}
+		$output->writeln($t->getName() . ' is ' . ($t->getAppendOnly() ? 'append-only' : 'normal') . '.');
+		return 0;
+	}
+}

lib/Command/TargetRemove.php

@@ -16,6 +16,7 @@ use Symfony\Component\Console\Output\OutputInterface;
 class TargetRemove extends Command {
 	public function __construct(
 		private TargetService $targets,
+		private \OCA\NgBackup\Service\AlertService $alerts,
 	) {
 		parent::__construct();
 	}
@@ -34,6 +35,7 @@ class TargetRemove extends Command {
 			return 1;
 		}
 		$this->targets->remove($t);
+		$this->alerts->securityEvent('target_removed', ['target' => $t->getName()]);
 		$output->writeln('Removed <info>' . $t->getName() . '</info>. The backups on the location itself were not touched; add it again to use them.');
 		return 0;
 	}

lib/Controller/AdminApiController.php

@@ -19,6 +19,8 @@ use OCA\NgBackup\Service\RestoreService;
 use OCA\NgBackup\Service\TargetService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataDownloadResponse;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\BackgroundJob\IJobList;
@@ -42,6 +44,7 @@ class AdminApiController extends Controller {
 		private IAppConfig $appConfig,
 		private IJobList $jobs,
 		private IUserSession $session,
+		private \OCA\NgBackup\Service\AlertService $alerts,
 	) {
 		parent::__construct(Application::APP_ID, $request);
 	}
@@ -64,6 +67,7 @@ class AdminApiController extends Controller {
 		]);
 	}
 
+	#[PasswordConfirmationRequired]
 	public function initKey(string $passphrase): JSONResponse {
 		try {
 			$this->keys->initialize($passphrase);
@@ -73,10 +77,18 @@ class AdminApiController extends Controller {
 		return new JSONResponse(['fingerprint' => $this->keys->fingerprint()]);
 	}
 
+	/**
+	 * Plain download link (no CSRF token on a navigation), therefore guarded by a recent password
+	 * confirmation instead, logged to the audit log and announced to all administrators. The kit
+	 * only holds the passphrase-wrapped key: useless without the passphrase.
+	 */
+	#[NoCSRFRequired]
+	#[PasswordConfirmationRequired]
 	public function downloadKit(): DataDownloadResponse|JSONResponse {
 		if (!$this->keys->isInitialized()) {
 			return new JSONResponse(['error' => 'No backup key yet'], Http::STATUS_BAD_REQUEST);
 		}
+		$this->alerts->securityEvent('kit_downloaded');
 		$json = json_encode($this->keys->recoveryKit(), JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
 		return new DataDownloadResponse($json, 'ng_backup-recovery-kit-' . $this->keys->fingerprint() . '.json', 'application/json');
 	}
@@ -103,8 +115,11 @@ class AdminApiController extends Controller {
 		return new JSONResponse(['id' => $r['target']->getId(), 'created' => $r['created']]);
 	}
 
+	#[PasswordConfirmationRequired]
 	public function removeTarget(int $id): JSONResponse {
-		$this->targets->remove($this->targets->get((string)$id));
+		$target = $this->targets->get((string)$id);
+		$this->targets->remove($target);
+		$this->alerts->securityEvent('target_removed', ['target' => $target->getName()]);
 		return new JSONResponse([]);
 	}
 
@@ -152,6 +167,7 @@ class AdminApiController extends Controller {
 	}
 
 	/** Queue a restore of user files; it runs as a background job and shows up in the runs. */
+	#[PasswordConfirmationRequired]
 	public function startRestore(int $targetId, string $snapshotId, string $path, string $mode = RestoreService::MODE_NEW_FOLDER): JSONResponse {
 		if (!in_array($mode, [RestoreService::MODE_NEW_FOLDER, RestoreService::MODE_MERGE, RestoreService::MODE_REPLACE], true)
 			|| !preg_match('#^data/[^/]+/files(/.*)?$#', $path)) {

lib/Db/Target.php

@@ -22,6 +22,8 @@ use OCP\AppFramework\Db\Entity;
  * @method void setBasePath(string $v)
  * @method string|null getRepositoryId()
  * @method void setRepositoryId(?string $v)
+ * @method bool|null getAppendOnly()
+ * @method void setAppendOnly(bool $v)
  * @method int getCreatedAt()
  * @method void setCreatedAt(int $v)
  */
@@ -33,8 +35,10 @@ class Target extends Entity {
 	protected string $basePath = '';
 	protected ?string $repositoryId = null;
 	protected int $createdAt = 0;
+	protected ?bool $appendOnly = null;
 
 	public function __construct() {
 		$this->addType('createdAt', 'integer');
+		$this->addType('appendOnly', 'boolean');
 	}
 }

lib/Migration/Version000003Date20261002020000.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+/** Append-only locations: NG Backup never deletes anything there (cleanup by the location's own lifecycle rules). */
+class Version000003Date20261002020000 extends SimpleMigrationStep {
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		/** @var ISchemaWrapper $schema */
+		$schema = $schemaClosure();
+		$t = $schema->getTable('ngb_targets');
+		if (!$t->hasColumn('append_only')) {
+			$t->addColumn('append_only', Types::BOOLEAN, ['notnull' => false, 'default' => false]);
+			return $schema;
+		}
+		return null;
+	}
+}

lib/Notification/Notifier.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Notification;
+
+use OCA\NgBackup\AppInfo\Application;
+use OCP\IURLGenerator;
+use OCP\L10N\IFactory;
+use OCP\Notification\INotification;
+use OCP\Notification\INotifier;
+use OCP\Notification\UnknownNotificationException;
+
+class Notifier implements INotifier {
+	public function __construct(
+		private IFactory $l10n,
+		private IURLGenerator $url,
+	) {
+	}
+
+	public function getID(): string {
+		return Application::APP_ID;
+	}
+
+	public function getName(): string {
+		return $this->l10n->get(Application::APP_ID)->t('NG Backup');
+	}
+
+	public function prepare(INotification $notification, string $languageCode): INotification {
+		if ($notification->getApp() !== Application::APP_ID) {
+			throw new UnknownNotificationException();
+		}
+		$l = $this->l10n->get(Application::APP_ID, $languageCode);
+		$p = $notification->getSubjectParameters();
+		switch ($notification->getSubject()) {
+			case 'run_failed':
+				$notification->setParsedSubject($p['kind'] === 'restore'
+					? $l->t('Restore from %s failed', [$p['target']])
+					: $l->t('Backup to %s failed', [$p['target']]));
+				$notification->setParsedMessage((string)($p['error'] ?? ''));
+				break;
+			case 'backup_stale':
+				$notification->setParsedSubject($l->t('No successful backup to %1$s since %2$s', [$p['target'], $p['since']]));
+				$notification->setParsedMessage($l->t('Check the backup settings and the server log.'));
+				break;
+			case 'security_event':
+				$who = (string)($p['actor'] ?? '');
+				$notification->setParsedSubject(match ($p['event'] ?? '') {
+					'kit_downloaded' => $l->t('%s downloaded the backup recovery kit', [$who]),
+					'target_removed' => $l->t('%1$s removed backup location %2$s', [$who, $p['target'] ?? '']),
+					'append_only_off' => $l->t('%1$s turned off append-only for backup location %2$s', [$who, $p['target'] ?? '']),
+					'retention_changed' => $l->t('%1$s changed the backup retention to %2$s', [$who, $p['policy'] ?? '']),
+					'snapshots_forgotten' => $l->t('%1$s removed %2$s snapshots from %3$s', [$who, $p['count'] ?? '', $p['target'] ?? '']),
+					default => $l->t('NG Backup security event'),
+				});
+				$notification->setParsedMessage($l->t('If this was not you or another administrator, check who has admin access.'));
+				break;
+			default:
+				throw new UnknownNotificationException();
+		}
+		$notification->setLink($this->url->linkToRouteAbsolute('settings.AdminSettings.index', ['section' => 'ng_backup']));
+		$notification->setIcon($this->url->getAbsoluteURL($this->url->imagePath(Application::APP_ID, 'app-dark.svg')));
+		return $notification;
+	}
+}

lib/Repository/BlobIndex.php

@@ -104,6 +104,26 @@ final class BlobIndex {
 		}
 	}
 
+	/** @return array<string, list<array{id:string, offset:int, length:int}>> packId => blobs currently located in that pack */
+	public function packs(): array {
+		$packs = [];
+		foreach ($this->blobs as $id => [$pack, $offset, $length]) {
+			$packs[$pack][] = ['id' => $id, 'offset' => $offset, 'length' => $length];
+		}
+		return $packs;
+	}
+
+	/** Forget a pack: delete its index file and cache row. Blobs that now live elsewhere are kept. */
+	public function removePack(string $packId): void {
+		$this->backend->delete('index/' . $packId);
+		$this->cache?->remove($this->repositoryId, [$packId]);
+		foreach ($this->blobs as $id => $loc) {
+			if ($loc[0] === $packId) {
+				unset($this->blobs[$id]);
+			}
+		}
+	}
+
 	public function count(): int {
 		return count($this->blobs);
 	}

lib/Repository/PackWriter.php

@@ -49,6 +49,16 @@ final class PackWriter {
 		return strlen($encrypted);
 	}
 
+	/** Add an already encrypted blob as-is (repacking: no decryption needed, the blob is bound to its id, not to a pack). */
+	public function addRaw(string $id, string $encrypted, int $rawLength, int $flags): void {
+		fwrite($this->buffer, $encrypted);
+		$this->entries[] = ['id' => $id, 'offset' => $this->size, 'length' => strlen($encrypted), 'raw' => $rawLength, 'flags' => $flags];
+		$this->size += strlen($encrypted);
+		if ($this->size >= $this->targetSize) {
+			$this->flush();
+		}
+	}
+
 	/** Upload the current pack (if any) and record it in the index. */
 	public function flush(): void {
 		if ($this->entries === []) {

lib/Repository/Repository.php

@@ -273,6 +273,103 @@ final class Repository {
 		return $data;
 	}
 
+	/** Remove a snapshot (and its database dump). Its data is freed by the next prune(). */
+	public function forget(string $snapshotId): void {
+		try {
+			$meta = $this->snapshotMeta($snapshotId);
+		} catch (\Throwable) {
+			$meta = [];
+		}
+		if (isset($meta['db']) && is_string($meta['db']) && str_starts_with($meta['db'], 'db/')) {
+			$this->backend->delete($meta['db']);
+		}
+		$this->backend->delete('snapshots/' . $snapshotId);
+	}
+
+	/**
+	 * Delete packs no snapshot or user export uses any more, and repack packs where more than
+	 * $repackThreshold of the bytes are unused. Must not run while a backup to this repository
+	 * is in progress (its blobs are not referenced by a snapshot yet); callers hold the lock.
+	 *
+	 * @return array{packs:int, deleted:int, repacked:int, freedBytes:int, keptBlobs:int, unusedBlobs:int}
+	 */
+	public function prune(bool $dryRun = false, float $repackThreshold = 0.5, array $ignoreSnapshots = []): array {
+		$used = [];
+		$ignore = array_flip($ignoreSnapshots); // e.g. snapshots a dry run would forget first
+		foreach ($this->listSnapshots() as $sid) {
+			if (isset($ignore[$sid])) {
+				continue;
+			}
+			foreach ($this->streamEntries($sid) as $e) {
+				foreach ($e['b'] as $b) {
+					$used[$b] = true;
+				}
+			}
+			$meta = $this->snapshotMeta($sid);
+			if (isset($meta['db']) && $this->backend->exists($meta['db'])) {
+				foreach (json_decode($this->getObject($meta['db']), true, 512, JSON_THROW_ON_ERROR)['tables'] as $t) {
+					foreach ($t['blobs'] as $b) {
+						$used[$b] = true;
+					}
+				}
+			}
+		}
+		foreach ($this->backend->list('users') as $path) {
+			foreach (json_decode($this->getObject($path), true, 512, JSON_THROW_ON_ERROR)['entries'] as $e) {
+				foreach ($e['b'] ?? [] as $b) {
+					$used[$b] = true;
+				}
+			}
+		}
+
+		$stats = ['packs' => 0, 'deleted' => 0, 'repacked' => 0, 'freedBytes' => 0, 'keptBlobs' => count($used), 'unusedBlobs' => 0];
+		$packs = $this->index->packs();
+		$stats['packs'] = count($packs);
+		$writer = null;
+		$toRemove = [];
+		foreach ($packs as $packId => $blobs) {
+			$total = 0;
+			$unused = 0;
+			foreach ($blobs as $b) {
+				$total += $b['length'];
+				if (!isset($used[$b['id']])) {
+					$unused += $b['length'];
+					$stats['unusedBlobs']++;
+				}
+			}
+			if ($unused === 0 || ($unused < $total && $unused / $total <= $repackThreshold)) {
+				continue;
+			}
+			$stats['freedBytes'] += $unused;
+			if ($unused === $total) {
+				$stats['deleted']++;
+			} else {
+				$stats['repacked']++;
+				if (!$dryRun) {
+					$writer ??= new PackWriter($this->backend, $this->cipher, $this->index);
+					$path = 'packs/' . substr($packId, 0, 2) . '/' . $packId;
+					foreach ($blobs as $b) {
+						if (isset($used[$b['id']])) {
+							[, , , $raw, $flags] = $this->index->get($b['id']);
+							$writer->addRaw($b['id'], $this->backend->getRange($path, $b['offset'], $b['length']), $raw, $flags);
+						}
+					}
+				}
+			}
+			$toRemove[] = $packId;
+		}
+		if ($dryRun) {
+			return $stats;
+		}
+		// New packs and their index entries are durable before any old pack is removed.
+		$writer?->flush();
+		foreach ($toRemove as $packId) {
+			$this->index->removePack($packId);
+			$this->backend->delete('packs/' . substr($packId, 0, 2) . '/' . $packId);
+		}
+		return $stats;
+	}
+
 	/** @return list<string> */
 	public function listSnapshots(): array {
 		return array_map('basename', $this->backend->list('snapshots'));

lib/Service/AlertService.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+use OCA\NgBackup\AppInfo\Application;
+use OCA\NgBackup\Db\Run;
+use OCA\NgBackup\Db\RunMapper;
+use OCA\NgBackup\Db\Target;
+use OCP\IGroupManager;
+use OCP\Notification\IManager;
+
+/** Notifies administrators about failed runs and locations without a recent successful backup. */
+class AlertService {
+	public const STALE_AFTER = 2 * 86400;
+
+	public function __construct(
+		private IManager $notifications,
+		private IGroupManager $groups,
+		private RunMapper $runs,
+		private \OCP\IAppConfig $appConfig,
+		private \OCP\EventDispatcher\IEventDispatcher $events,
+		private \OCP\IUserSession $session,
+	) {
+	}
+
+	/**
+	 * Security-relevant change (recovery kit downloaded, location removed, append-only off,
+	 * retention changed, snapshots forgotten): written to the audit log (admin_audit) and sent
+	 * to every administrator, so a single compromised admin account cannot do it unnoticed.
+	 *
+	 * @param array<string, string> $params
+	 */
+	public function securityEvent(string $event, array $params = [], bool $notify = true): void {
+		$actor = $this->session->getUser()?->getUID() ?? (PHP_SAPI === 'cli' ? 'occ' : 'unknown');
+		$params = ['actor' => $actor] + $params;
+		$this->events->dispatchTyped(new \OCP\Log\Audit\CriticalActionPerformedEvent(
+			'NG Backup: %s by %s ' . json_encode(array_diff_key($params, ['actor' => 1]), JSON_UNESCAPED_SLASHES), ['event' => $event, 'actor' => $actor]));
+		if ($notify) {
+			$this->notifyAdmins('security_event', $event . '-' . time(), ['event' => $event] + $params);
+		}
+	}
+
+	public function runFailed(Run $run, string $targetName): void {
+		$this->notifyAdmins('run_failed', 'run-' . $run->getId(),
+			['kind' => $run->getKind(), 'target' => $targetName, 'error' => mb_strimwidth((string)$run->getError(), 0, 300, '…')]);
+	}
+
+	/** At most one notification per location per day. */
+	public function checkStale(Target $target): void {
+		$last = $this->runs->lastFinished($target->getId(), BackupService::KIND_FULL);
+		$lastTime = $last?->getFinishedAt() ?? $target->getCreatedAt();
+		if (time() - $lastTime < self::STALE_AFTER || $this->runs->findRunning($target->getId(), BackupService::KIND_FULL) !== []) {
+			return;
+		}
+		$key = 'stale_notified_' . $target->getId();
+		if ($this->appConfig->getValueString(Application::APP_ID, $key, '') === date('Y-m-d')) {
+			return;
+		}
+		$this->appConfig->setValueString(Application::APP_ID, $key, date('Y-m-d'));
+		$this->notifyAdmins('backup_stale', 'stale-' . $target->getId() . '-' . date('Y-m-d'),
+			['target' => $target->getName(), 'since' => $last ? date('Y-m-d H:i', $lastTime) : 'never']);
+	}
+
+	private function notifyAdmins(string $subject, string $objectId, array $params): void {
+		foreach ($this->groups->get('admin')?->getUsers() ?? [] as $admin) {
+			$n = $this->notifications->createNotification();
+			$n->setApp(Application::APP_ID)
+				->setUser($admin->getUID())
+				->setDateTime(new \DateTime())
+				->setObject($subject, $objectId)
+				->setSubject($subject, $params);
+			$this->notifications->notify($n);
+		}
+	}
+}

lib/Service/BackupService.php

@@ -41,6 +41,7 @@ class BackupService {
 		private IAppManager $appManager,
 		private ILockingProvider $locking,
 		private LoggerInterface $logger,
+		private AlertService $alerts,
 	) {
 	}
 
@@ -51,6 +52,9 @@ class BackupService {
 		if ($this->config->getSystemValue('objectstore', null) !== null) {
 			throw new \RuntimeException('Object storage as primary storage is not supported yet');
 		}
+		if ($this->locking->isLocked(PruneService::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE)) {
+			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is running; try again later');
+		}
 		$running = $this->runs->findRunning($target->getId(), self::KIND_FULL);
 		if ($running !== []) {
 			return $running[0];
@@ -129,7 +133,12 @@ class BackupService {
 			$run->setError($e->getMessage());
 			$run->setFinishedAt(time());
 			$run->setUpdatedAt(time());
-			return $this->runs->update($run);
+			$run = $this->runs->update($run);
+			try {
+				$this->alerts->runFailed($run, isset($target) ? $target->getName() : '#' . $run->getTargetId());
+			} catch (\Throwable) {
+			}
+			return $run;
 		} finally {
 			$this->locking->releaseLock($lockKey, ILockingProvider::LOCK_EXCLUSIVE);
 		}

lib/Service/PruneService.php

@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+use OCA\NgBackup\AppInfo\Application;
+use OCA\NgBackup\Db\RunMapper;
+use OCA\NgBackup\Db\SnapshotMapper;
+use OCA\NgBackup\Db\Target;
+use OCP\IAppConfig;
+use OCP\Lock\ILockingProvider;
+use OCP\Lock\LockedException;
+
+/**
+ * Applies the retention policy to a location: forgets snapshots the policy does not keep and
+ * prunes data no remaining snapshot uses. Never runs on append-only locations, never while a
+ * backup to the same location is running (the location lock is shared with BackupService).
+ */
+class PruneService {
+	public function __construct(
+		private TargetService $targets,
+		private RunMapper $runs,
+		private SnapshotMapper $snapshots,
+		private IAppConfig $appConfig,
+		private ILockingProvider $locking,
+		private AlertService $alerts,
+	) {
+	}
+
+	public static function lockKey(Target $target): string {
+		return 'ng_backup/target/' . $target->getId();
+	}
+
+	public function policy(): RetentionPolicy {
+		return RetentionPolicy::fromArray(json_decode($this->appConfig->getValueString(Application::APP_ID, 'retention', '{}'), true) ?: []);
+	}
+
+	public function setPolicy(RetentionPolicy $policy): void {
+		if ($policy->last < 1) {
+			throw new \InvalidArgumentException('Keep at least the last snapshot');
+		}
+		$old = $this->policy()->toArray();
+		$this->appConfig->setValueString(Application::APP_ID, 'retention', json_encode($policy->toArray(), JSON_THROW_ON_ERROR));
+		if ($old !== $policy->toArray()) {
+			$this->alerts->securityEvent('retention_changed', ['policy' => json_encode($policy->toArray())]);
+		}
+	}
+
+	/**
+	 * @return array{kept: array<string, list<string>>, forgotten: list<string>, prune: array}
+	 */
+	public function apply(Target $target, bool $dryRun = false, bool $scheduled = false): array {
+		if ($target->getAppendOnly()) {
+			throw new \RuntimeException('Location ' . $target->getName() . ' is append-only: NG Backup does not delete anything there');
+		}
+		if ($this->runs->findRunning($target->getId(), BackupService::KIND_FULL) !== []) {
+			throw new \RuntimeException('A backup to ' . $target->getName() . ' is running; try again later');
+		}
+		try {
+			$this->locking->acquireLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
+		} catch (LockedException) {
+			throw new \RuntimeException('Another backup or cleanup of ' . $target->getName() . ' is running');
+		}
+		try {
+			$repo = $this->targets->repository($target);
+			$times = [];
+			foreach ($repo->listSnapshots() as $id) {
+				$meta = $repo->snapshotMeta($id);
+				$times[$id] = (int)strtotime((string)($meta['time'] ?? '@0'));
+			}
+			$keep = $this->policy()->keep($times);
+			$forget = array_values(array_diff(array_keys($times), array_keys($keep)));
+			if (!$dryRun) {
+				foreach ($forget as $id) {
+					$repo->forget($id);
+					try {
+						$this->snapshots->delete($this->snapshots->findOne($target->getId(), $id));
+					} catch (\Throwable) {
+					}
+				}
+			}
+			// Also removes leftovers of interrupted runs. A dry run counts the snapshots it would forget as gone.
+			if (!$dryRun && $forget !== []) {
+				// Scheduled cleanup follows the policy: audit log only, no notification every week.
+				$this->alerts->securityEvent('snapshots_forgotten', ['target' => $target->getName(), 'count' => (string)count($forget)], !$scheduled);
+			}
+			$prune = $repo->prune($dryRun, 0.5, $dryRun ? $forget : []);
+			return ['kept' => $keep, 'forgotten' => $forget, 'prune' => $prune];
+		} finally {
+			$this->locking->releaseLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
+		}
+	}
+}

lib/Service/RetentionPolicy.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+/**
+ * Which snapshots to keep: the newest $last, plus the newest snapshot of each of the most recent
+ * $daily days, $weekly ISO weeks and $monthly months that have a snapshot (like restic/borg).
+ */
+final class RetentionPolicy {
+	public function __construct(
+		public readonly int $last = 3,
+		public readonly int $daily = 7,
+		public readonly int $weekly = 4,
+		public readonly int $monthly = 6,
+	) {
+	}
+
+	public static function fromArray(array $a): self {
+		return new self((int)($a['last'] ?? 3), (int)($a['daily'] ?? 7), (int)($a['weekly'] ?? 4), (int)($a['monthly'] ?? 6));
+	}
+
+	public function toArray(): array {
+		return ['last' => $this->last, 'daily' => $this->daily, 'weekly' => $this->weekly, 'monthly' => $this->monthly];
+	}
+
+	/**
+	 * @param array<string, int> $snapshots id => unix time
+	 * @return array<string, list<string>> id => reasons it is kept (ids not in the result are removed)
+	 */
+	public function keep(array $snapshots): array {
+		arsort($snapshots);
+		$keep = [];
+		$i = 0;
+		foreach ($snapshots as $id => $time) {
+			if ($i++ < $this->last) {
+				$keep[$id][] = 'last';
+			}
+		}
+		foreach (['daily' => 'Y-m-d', 'weekly' => 'o-W', 'monthly' => 'Y-m'] as $kind => $format) {
+			$seen = [];
+			foreach ($snapshots as $id => $time) {
+				$bucket = date($format, $time);
+				if (isset($seen[$bucket])) {
+					continue;
+				}
+				if (count($seen) >= $this->$kind) {
+					break;
+				}
+				$seen[$bucket] = true;
+				$keep[$id][] = $kind;
+			}
+		}
+		return $keep;
+	}
+}

lib/Service/TargetService.php

@@ -89,6 +89,11 @@ class TargetService {
 		return ctype_digit($nameOrId) ? $this->mapper->find((int)$nameOrId) : $this->mapper->findByName($nameOrId);
 	}
 
+	public function setAppendOnly(Target $target, bool $appendOnly): Target {
+		$target->setAppendOnly($appendOnly);
+		return $this->mapper->update($target);
+	}
+
 	/** Remove the target from NG Backup. The backups on the target itself are not touched. */
 	public function remove(Target $target): void {
 		$this->mapper->delete($target);

lib/SetupCheck/BackupStatusCheck.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\SetupCheck;
+
+use OCA\NgBackup\Db\Run;
+use OCA\NgBackup\Db\RunMapper;
+use OCA\NgBackup\Service\AlertService;
+use OCA\NgBackup\Service\BackupService;
+use OCA\NgBackup\Service\KeyService;
+use OCA\NgBackup\Service\TargetService;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+/** Shows the backup state in the admin overview (Security & setup warnings). */
+class BackupStatusCheck implements ISetupCheck {
+	public function __construct(
+		private IL10N $l,
+		private IURLGenerator $url,
+		private KeyService $keys,
+		private TargetService $targets,
+		private RunMapper $runs,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function getName(): string {
+		return $this->l->t('NG Backup');
+	}
+
+	public function run(): SetupResult {
+		$link = $this->url->linkToRouteAbsolute('settings.AdminSettings.index', ['section' => 'ng_backup']);
+		if (!$this->keys->isInitialized() || $this->keys->recoveryKitConfirmation() === null) {
+			return SetupResult::error($this->l->t('Backups are not set up: create the backup key and confirm the recovery kit.'), $link);
+		}
+		$targets = $this->targets->list();
+		if ($targets === []) {
+			return SetupResult::warning($this->l->t('No backup location is configured.'), $link);
+		}
+		$problems = [];
+		foreach ($targets as $t) {
+			$last = $this->runs->lastFinished($t->getId(), BackupService::KIND_FULL);
+			if ($last === null) {
+				$problems[] = $this->l->t('%s: no successful backup yet', [$t->getName()]);
+			} elseif (time() - (int)$last->getFinishedAt() > AlertService::STALE_AFTER) {
+				$problems[] = $this->l->t('%1$s: last successful backup %2$s', [$t->getName(), date('Y-m-d H:i', (int)$last->getFinishedAt())]);
+			}
+		}
+		foreach ($this->runs->findRecent(10) as $r) {
+			if ($r->getStatus() === Run::FAILED && $r->getStartedAt() > time() - AlertService::STALE_AFTER) {
+				$problems[] = $this->l->t('A %1$s run failed: %2$s', [$r->getKind(), mb_strimwidth((string)$r->getError(), 0, 120, '…')]);
+				break;
+			}
+		}
+		return $problems === []
+			? SetupResult::success($this->l->t('Recent backups to all locations succeeded.'))
+			: SetupResult::warning(implode("\n", $problems), $link);
+	}
+}

package-lock.json

@@ -12,6 +12,7 @@
 				"@nextcloud/axios": "^2.5.1",
 				"@nextcloud/dialogs": "^7.4.0",
 				"@nextcloud/l10n": "^3.4.0",
+				"@nextcloud/password-confirmation": "^6.1.0",
 				"@nextcloud/router": "^3.0.1",
 				"@nextcloud/vue": "^9.0.0",
 				"vue": "^3.5.0"
@@ -885,6 +886,24 @@
 				"node": "^20.0.0 || ^22.0.0 || ^24.0.0"
 			}
 		},
+		"node_modules/@nextcloud/password-confirmation": {
+			"version": "6.1.0",
+			"resolved": "https://registry.npmjs.org/@nextcloud/password-confirmation/-/password-confirmation-6.1.0.tgz",
+			"integrity": "sha512-N2ChXDbPcUcQCoAjj1yc65zfc61yiKpdM3qm/y3Y/y//NG7XWNNINwBg85lqJ2SISgmVStpsQ1d0blpFCoQXkQ==",
+			"license": "MIT",
+			"dependencies": {
+				"@nextcloud/auth": "^2.5.3",
+				"@nextcloud/axios": "^2.5.2",
+				"@nextcloud/l10n": "^3.4.1",
+				"@nextcloud/logger": "^3.0.3",
+				"@nextcloud/router": "^3.1.0",
+				"@nextcloud/vue": "^9.6.0",
+				"vue": "^3.5.30"
+			},
+			"engines": {
+				"node": "^20.0.0 || ^22.0.0 || ^24.0.0"
+			}
+		},
 		"node_modules/@nextcloud/paths": {
 			"version": "3.1.0",
 			"resolved": "https://registry.npmjs.org/@nextcloud/paths/-/paths-3.1.0.tgz",

package.json

@@ -12,6 +12,7 @@
 		"@nextcloud/axios": "^2.5.1",
 		"@nextcloud/dialogs": "^7.4.0",
 		"@nextcloud/l10n": "^3.4.0",
+		"@nextcloud/password-confirmation": "^6.1.0",
 		"@nextcloud/router": "^3.0.1",
 		"@nextcloud/vue": "^9.0.0",
 		"vue": "^3.5.0"

src/components/KeySetup.vue

@@ -23,7 +23,7 @@
 				<NcNoteCard type="warning">
 					{{ t('ng_backup', 'Before the first backup: download the recovery kit and store it, together with your passphrase, somewhere safe outside this server.') }}
 				</NcNoteCard>
-				<NcButton :href="kitUrl" download @click="downloaded = true">
+				<NcButton @click="downloadKit">
 					{{ t('ng_backup', 'Download recovery kit') }}
 				</NcButton>
 				<NcCheckboxRadioSwitch v-model="accepted" :disabled="!downloaded">
@@ -35,7 +35,8 @@
 			</div>
 			<p v-else>
 				{{ t('ng_backup', 'Recovery kit confirmed by {user} on {date}.', { user: status.key.confirmation.uid, date: new Date(status.key.confirmation.time * 1000).toLocaleString() }) }}
-				<a :href="kitUrl" download>{{ t('ng_backup', 'Download the kit again') }}</a>
+				<NcButton variant="tertiary" @click="downloadKit">{{ t('ng_backup', 'Download the kit again') }}</NcButton>
+				<span class="ngb-muted">{{ t('ng_backup', 'Requires your password; all administrators are notified.') }}</span>
 			</p>
 		</template>
 		<NcNoteCard v-if="error" type="error">{{ error }}</NcNoteCard>
@@ -50,6 +51,8 @@ import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwit
 import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
 import NcPasswordField from '@nextcloud/vue/components/NcPasswordField'
 import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
+import { confirmPassword } from '@nextcloud/password-confirmation'
+import '@nextcloud/password-confirmation/style.css'
 import api from '../api.js'
 
 const props = defineProps({ status: { type: Object, required: true } })
@@ -63,10 +66,22 @@ const busy = ref(false)
 const error = ref('')
 const kitUrl = api.kitUrl()
 
+async function downloadKit() {
+	error.value = ''
+	try {
+		await confirmPassword()
+		window.location.href = kitUrl
+		downloaded.value = true
+	} catch (e) {
+		error.value = e?.message || ''
+	}
+}
+
 async function createKey() {
 	busy.value = true
 	error.value = ''
 	try {
+		await confirmPassword()
 		await api.initKey(pass1.value)
 		pass1.value = pass2.value = ''
 		emit('changed')
@@ -92,6 +107,7 @@ async function confirm() {
 </script>
 
 <style scoped>
+.ngb-muted { color: var(--color-text-maxcontrast); margin-inline-start: 8px; }
 .ngb-form, .ngb-confirm {
 	display: flex;
 	flex-direction: column;

src/components/Locations.vue

@@ -47,6 +47,8 @@ import NcPasswordField from '@nextcloud/vue/components/NcPasswordField'
 import NcSelect from '@nextcloud/vue/components/NcSelect'
 import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
 import NcTextField from '@nextcloud/vue/components/NcTextField'
+import { confirmPassword } from '@nextcloud/password-confirmation'
+import '@nextcloud/password-confirmation/style.css'
 import api from '../api.js'
 
 defineProps({ status: { type: Object, required: true } })
@@ -107,7 +109,13 @@ async function remove(target) {
 	if (!window.confirm(t('ng_backup', 'Remove "{name}" from NG Backup? The backups on the location itself are kept.', { name: target.name }))) {
 		return
 	}
-	await api.removeTarget(target.id)
+	try {
+		await confirmPassword()
+		await api.removeTarget(target.id)
+	} catch (e) {
+		error.value = e?.message || ''
+		return
+	}
 	emit('changed')
 }
 </script>

src/components/RestoreBrowser.vue

@@ -49,6 +49,8 @@ import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
 import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
 import NcSelect from '@nextcloud/vue/components/NcSelect'
 import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
+import { confirmPassword } from '@nextcloud/password-confirmation'
+import '@nextcloud/password-confirmation/style.css'
 import api from '../api.js'
 import { formatSize } from '../format.js'
 
@@ -107,6 +109,7 @@ async function restore() {
 	busy.value = true
 	error.value = message.value = ''
 	try {
+		await confirmPassword()
 		await api.startRestore(target.value.id, snapshot.value.id, selected.value, mode.value)
 		message.value = t('ng_backup', 'Restore queued. It runs with the next cron job; progress is shown under Backups.')
 		emit('changed')

tests/Unit/Repository/PruneTest.php

@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Repository;
+
+use OCA\NgBackup\Backend\LocalBackend;
+use OCA\NgBackup\Crypto\KeyRing;
+use OCA\NgBackup\Repository\Repository;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use PHPUnit\Framework\TestCase;
+
+class PruneTest extends TestCase {
+	use TempDirTrait;
+
+	private function du(LocalBackend $b): int {
+		$root = (new \ReflectionProperty(LocalBackend::class, 'root'))->getValue($b);
+		$total = 0;
+		foreach ($b->list('packs') as $p) {
+			$total += filesize("$root/$p");
+		}
+		return $total;
+	}
+
+	public function testForgetAndPruneFreesSpaceAndKeepsTheRest(): void {
+		$src = $this->tempDir();
+		$backend = new LocalBackend($this->tempDir());
+		$keys = KeyRing::generate();
+		$repo = Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
+
+		file_put_contents("$src/keep.bin", random_bytes(6 * 1048576));
+		file_put_contents("$src/old.bin", random_bytes(40 * 1048576));
+		$old = $repo->backupDirectory($src);
+		unlink("$src/old.bin");
+		file_put_contents("$src/new.bin", random_bytes(3 * 1048576));
+		$new = $repo->backupDirectory($src, $old['snapshot']);
+		$expected = self::hashTree($src);
+		$before = $this->du($backend);
+
+		$dry = $repo->prune(true);
+		$this->assertSame(0, $dry['freedBytes'], 'nothing is unused while both snapshots exist');
+		$preview = $repo->prune(true, 0.5, [$old['snapshot']]);
+		$this->assertGreaterThan(35 * 1048576, $preview['freedBytes'], 'dry run can preview forgetting a snapshot');
+
+		$repo->forget($old['snapshot']);
+		$plan = $repo->prune(true);
+		$this->assertSame($plan, $repo->prune(true, 0.5, []));
+		$this->assertGreaterThan(35 * 1048576, $plan['freedBytes']);
+		$this->assertSame($before, $this->du($backend), 'dry run changes nothing');
+
+		$result = $repo->prune();
+		$this->assertGreaterThan(0, $result['deleted'] + $result['repacked']);
+		$this->assertLessThan($before - 35 * 1048576, $this->du($backend));
+
+		$reopened = Repository::openWithKey($backend, $keys);
+		$target = $this->tempDir();
+		$reopened->restore($new['snapshot'], $target);
+		$this->assertSame($expected, self::hashTree($target));
+		$this->assertSame([$new['snapshot']], $reopened->listSnapshots());
+	}
+
+	public function testRepackKeepsUsedBlobsOfMixedPacks(): void {
+		$src = $this->tempDir();
+		$backend = new LocalBackend($this->tempDir());
+		$keys = KeyRing::generate();
+		$repo = Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
+		// Small files share packs: deleting most of them leaves mixed packs to repack.
+		for ($i = 0; $i < 40; $i++) {
+			file_put_contents("$src/f$i", random_bytes(500000));
+		}
+		$a = $repo->backupDirectory($src);
+		for ($i = 0; $i < 40; $i++) {
+			if ($i % 5 !== 0) {
+				unlink("$src/f$i");
+			}
+		}
+		$b = $repo->backupDirectory($src, $a['snapshot']);
+		$repo->forget($a['snapshot']);
+		$r = $repo->prune(false, 0.5);
+		$this->assertGreaterThan(0, $r['repacked']);
+		$target = $this->tempDir();
+		Repository::openWithKey($backend, $keys)->restore($b['snapshot'], $target);
+		$this->assertSame(self::hashTree($src), self::hashTree($target));
+	}
+}

tests/Unit/Service/RetentionPolicyTest.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Service;
+
+use OCA\NgBackup\Service\RetentionPolicy;
+use PHPUnit\Framework\TestCase;
+
+class RetentionPolicyTest extends TestCase {
+	public function testDailyWeeklyMonthly(): void {
+		$snaps = [];
+		$start = strtotime('2026-01-01 03:00:00');
+		for ($d = 0; $d < 120; $d++) {
+			$snaps["d$d"] = $start + $d * 86400;          // one per day for 120 days
+			$snaps["d$d-b"] = $start + $d * 86400 + 3600; // and a second one an hour later
+		}
+		$keep = (new RetentionPolicy(2, 7, 4, 3))->keep($snaps);
+		$this->assertArrayHasKey('d119-b', $keep, 'newest is always kept');
+		$this->assertArrayHasKey('d119', $keep, 'last=2');
+		$this->assertContains('daily', $keep['d113-b']);
+		$this->assertArrayNotHasKey('d113', $keep, 'only the newest of a day');
+		$this->assertLessThanOrEqual(2 + 7 + 4 + 3, count($keep));
+		$months = array_unique(array_map(fn ($id) => date('Y-m', $snaps[$id]), array_keys(array_filter($keep, fn ($r) => in_array('monthly', $r, true)))));
+		$this->assertCount(3, $months);
+	}
+
+	public function testKeepsEverythingWhenFewSnapshots(): void {
+		$keep = (new RetentionPolicy())->keep(['a' => 100, 'b' => 200]);
+		$this->assertSame(['a', 'b'], array_values(array_intersect(['a', 'b'], array_keys($keep))));
+	}
+}