[witbrock]

The migration's existing encrypted database backup is 1.27 GB. Backup encryption and restore decryption previously loaded entire files into memory, exceeding the bounded resource budget needed to recover after the earlier machine crash.

Stream the existing Fernet format through private temporary files using Cryptography's AES-CBC, PKCS7 and HMAC primitives. Authenticate the whole ciphertext before decrypting, and publish completed output atomically. Invalid input and failed publication preserve any existing destination. Backup filenames, key format and retention timestamps remain compatible. This follows the Fernet format; the ordinary library's whole-message memory requirement explains the previous allocation.

Validation: 51 targeted backup, restore and encryption tests pass. Tests cover ordinary Fernet interoperability across AES/base64/chunk boundaries, wrong keys, tampering, malformed/truncated input, authenticated invalid padding, publication failure, destination preservation and no whole-file reads at the operator entrypoints. No new Ruff findings.

The actual 1,271,220,260-byte earlier backup decrypted successfully; all 94 ZIP members passed CRC checks. Streamed re-encryption and decryption reproduced its 953,415,126-byte plaintext SHA-256 exactly. The shared guard observed a peak of 0.234 GiB across the probe and active import workers; temporary plaintext was removed. This proves this file-codec path, not the still-pending fresh paired database/blob restore or overall cutover. Source captures and audit artefacts remain outside Git.

Merge decision: ready, subject to required CI. No change to task/project writer authority or running-system activation.