wip: native-auth pin script, tests and qualification notes

Recovered from an uncommitted worktree during the 2026-11-07 cleanup. Based on the 2026-11-01 release-qualification branch, so dev/ docs and scripts may be stale relative to main; review before opening a PR.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

dev/java/S3PrintingQualification.java

@@ -78,6 +78,11 @@ public final class S3PrintingQualification {
       s3.putObject(PutObjectRequest.builder().bucket(otherBucket).key("canary.txt").build(), RequestBody.fromString("synthetic separate bucket"));
       PrintingService a = service(instance, "fixture-tenant-a");
       PrintingService b = service(instance, "fixture-tenant-b");
+      for(PrintingService tenantService : List.of(a, b)) {
+        JSONObject defaults = tenantService.getRetentionSettings();
+        check(defaults.getInt("days") == 365 && defaults.getBoolean("enabled"), "fresh tenant defaults to enabled 365-day retention");
+        check(bucket.equals(defaults.getString("bucketName")) && !otherBucket.equals(defaults.getString("bucketName")), "administration reports the dedicated fixture bucket, not the canary bucket");
+      }
       String deviceA = enroll(a);
       String deviceB = enroll(b);
       byte[] pdf = PrintingTestDocuments.pdf();
@@ -128,6 +133,20 @@ public final class S3PrintingQualification {
       check(s3.getObjectAsBytes(GetObjectRequest.builder().bucket(otherBucket).key("canary.txt").build()).asUtf8String().equals("synthetic separate bucket"), "separate bucket canary preserved");
       check(a.runRetention() == 0, "repeated cleanup is idempotent");
       check(b.runRetention() == 1, "tenant B cleanup independently removes its one eligible document");
+      String adjustedReference = reference(zplJob);
+      execute("UPDATE printing_job SET completed_at=? WHERE id=?", Instant.now().minusSeconds(40L * 86400).toString(), zplJob);
+      check(a.getRetentionSettings().getLong("eligibleBacklog") == 0, "a 40-day-old document is not eligible under the 365-day default");
+      a.saveRetentionSettings(30, false, 200);
+      check(a.runRetention() == 0, "administrator-disabled retention removes nothing");
+      check(s3.headObject(HeadObjectRequest.builder().bucket(bucket).key(objectKey(adjustedReference)).build()).contentLength() == zpl.length, "disabled retention leaves the object in S3");
+      a.saveRetentionSettings(30, true, 1);
+      JSONObject adjusted = a.getRetentionSettings();
+      check(adjusted.getInt("days") == 30 && adjusted.getInt("batchSize") == 1 && adjusted.getLong("eligibleBacklog") == 1, "administrator 30-day setting and batch bound are persisted and reported");
+      check(b.getRetentionSettings().getInt("days") == 365, "tenant A administrator change does not alter tenant B");
+      check(a.runRetention() == 1, "administrator-adjusted retention removes exactly the one now-eligible document");
+      missing(objectKey(adjustedReference));
+      a.saveRetentionSettings(365, true, 200);
+      check(a.getRetentionSettings().getInt("days") == 365, "administrator restores the 365-day default");
       check(s3.listMultipartUploads(ListMultipartUploadsRequest.builder().bucket(bucket).build()).uploads().isEmpty(), "no incomplete multipart uploads remain");
       check(QContext.getQSession() == null, "storage restores original absent QQQ session");
       JSONObject result = new JSONObject().put("passed", true).put("timestamp", Instant.now().toString())