The disposable vendor

The first three notes removed a coupling to a dependency we didn't own — a rate-limited secrets service in a hot path. This one is the same move on a bigger axis: the coupling to a storage vendor we don't own. The fix isn't picking the right vendor. It's making any vendor one you can walk away from.

A vendor got purged, and nothing broke

The second cold-storage vendor was Wasabi. Its pricing punishes exactly what a backup does — churn — so it was cut. That should have been the painful part: a year of backups written into one company's storage, and now you're leaving. In most shops that's a migration project, a quarter of someone's life, a tense cutover.

Here it was a line of config. The corpus walked away clean because of how it was written, not where. That's the whole note: the cost of leaving a vendor is decided long before you leave — at the moment you choose what writes your data.

The weakness was never which vendor. It was being unable to leave one.

Three layers, and only one is disposable

The stack that made the exit free is restic over rclone. Read top to bottom, it's a deliberate separation of who owns what:

• rclone — the vendor-independence layer. Roughly seventy storage backends behind one identical interface. The vendor stops being an architecture and becomes a variable. pCloud today is just the current value of it; B2, S3, an SFTP box, a Drive — each is a remote definition, not a rewrite.
• restic — the trust layer. Encryption, integrity, dedup, versioning, retention, tags — all of it runs client-side, on our machines, before a byte leaves home. The repository format is identical no matter what sits beneath it. This is where the smarts live, and we own all of them.
• the vendor — disposable. Because it carries none of the smarts, it carries none of the lock-in. It holds opaque encrypted blobs and hands them back on request. Swap it and you restic copy to a new remote and leave. Nothing is re-encrypted, no repo is rebuilt, no tool is rewritten.

Antifragility, in the earlier notes, was removing a coupling so a failure couldn't cascade. The coupling here is commercial, not technical — a vendor that raises prices, degrades, or changes its terms — but the cure is the same shape: don't harden the relationship with the thing you don't control. Remove the dependence on it.

What the portability actually buys

1. The lifetime bet stops being lock-in. A ten-year prepaid plan is normally a trap — you're married to one vendor for a decade. But a bet you can abandon for the price of a restic copy isn't a marriage; it's a cheap option. If the vendor disappoints, you lose the storage you'd already amortised to near-zero, not the corpus and not the architecture.
2. A third vendor is free. Fan-out isn't a project. Another cold vendor is another rclone remote and another mirror job from the same scaffold, governed by the same restic discipline. The store gets stronger as vendors are added — the antifragile signature.
3. The only tax is per-backend tuning. A new backend may need one knob turned — pack size for a high-latency object store, connection count for a throttled one. A configuration value, never a code change, and paid once.

The posture

Stated as an operating principle, plain enough to govern a decision a year from now:

Own the trust layer. Rent the storage. No single vendor can hold you hostage.

The trust layer — encryption, integrity, versioning — is the part that must never be rented, because renting it is what creates lock-in and what puts your confidentiality in someone else's hands. The storage is the part that should always be rented, from whoever is cheapest this year, because you've built the system so the answer can change without ceremony. Notes № 1 through № 3 proved the method on a dependency. This one proves it's a method and not a story: the same move — remove the coupling to the thing you don't own — holds when the thing you don't own is a company.