Recovery on one page: docs/RECOVERY.md with the restore command, the boot on a side port, the manual tarball route, and a weekly drill that posts its result #1219

The forge now has a keyed snapshot in Backblaze (first: 2026-10-13T00-45-35Z, 350 MiB, 110 repositories) and a restore drill that brought it back on the droplet host in 81 minutes (#1147 has the counts). What it does not have is the one page a person reads at 3 a.m.: docs/RECOVERY.md.

Done looks like:

• [ ] docs/RECOVERY.md, short enough to print on one side: where the snapshots live (bucket, prefix, region), the five environment variables a restore needs (S3_ENDPOINT S3_BUCKET S3_REGION S3_ACCESS_KEY S3_SECRET_KEY) and the passphrase (FORGE_SNAPSHOT_PASSPHRASE, kept in the owner's safe), the one command (bun run src/snapshot/restore.ts <snapshot-name> <empty data dir>), how to boot the forge on that directory on a side port and what to look at first (/api/v1/health, the home as the owner, one repository's issues), and what is NOT in a snapshot (sealed values, app variables, the crew's clones).
• [ ] The manual tarball path as the second route: manual/<stamp>/ in the same bucket, openssl enc -d -aes-256-cbc -pbkdf2 -pass file:<passphrase> then untar; when to prefer it.
• [ ] A weekly restore drill: a scheduled run (the forge's own routine, or a workflow in .forgejo/workflows/) that restores the latest snapshot into a scratch directory, boots it on a side port, reads health and counts, and posts the result as a comment on this repository's recovery issue; a failed drill is an inbox card.
• [ ] test/recovery-doc.test.ts: the document names every environment variable src/snapshot/store.ts reads and the restore command exactly as src/snapshot/restore.ts prints it, so the notecard cannot drift from the code.

Evidence and numbers: #1147's comments from 2026-10-13.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1222 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1425 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1222 closed)
2. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1425 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1480 and #1481. #1480 is docs/RECOVERY.md with a test that keeps it true to src/snapshot; its test file is named in GATE, which is what both tries missed. #1481 makes the weekly drill post its verdict here and turn a failure into an inbox card. It waits for #1182, which is the drill itself, so the drill is not built twice.