That's a good question. The method Certbot uses to determine the next number in sequence is not documented. Some experimentation needed to see how its done and hope no changes. Or, review its code in github.
I can imagine two other methods than the one you describe:
- Use first available number from beginning of /archive/ sequence
- Add 1 to largest existing number in /archive/
Normally of course /live/ points to the largest used number but you could manually change the symlinks to a previous one for various reasons. I don't know if you have ever done this or if this would mess up Certbot. I did it once when I created a staging cert and pointed the symlink to the prior production cert. I don't remember what happened on that test system later.
My guess is you could remove any older /archive/ files but I would retain anything created in the last 90 days as they are still usable (in odd cases).
BUT, testing carefully is required.
EDIT:
In this thread _az, a Certbot dev, said csr and keys could be deleted. The link in a later post in that thread addresses the purge cycle you ask about.
Also @schoen was asking for input on this from an insider group earlier this year. Maybe he can add clarity.