# Reviewed candidate backup client refresh

Prepared from railiance-platform source `f1a780d830a118eecdc0ada1885e7b8f95b51072`;
immutable Forgejo ConfigMap `backup-verified-debb9e4c59c9` and its existing mount
patch are review artifacts. This directory is excluded from ordinary GitOps
kustomization and has not been applied. It preserves existing env and other mounts.

Before runtime promotion:

1. Repair repo-manager historical `custodian-WP-*` identifier compatibility without
   renumbering those owner records. Exact primary projection is currently unproved.
2. Synchronize approved railiance-platform source on railiance01, so CNPG's
   existing hostPath receives the corrected public DAV header. This ConfigMap
   updates Forgejo only; it does not update CNPG.
3. Confirm ESO's refreshed lane after KV4 publication, using safe metadata and
   privately compared credential equality if needed, never printed Secret bodies.
4. Review the immutable bundle and scoped mount patch, then incorporate the new
   ConfigMap and volume reference into the adopted `k8s/gitops` source. Use reviewed
   ArgoCD sync rather than the old direct deployment patch helper. Keep the old
   immutable bundle until no rollback ReplicaSet references it.
5. Verify worker recreation after source/ESO refresh, run
   `python3 scripts/inspect_backup_delivery.py --platform-root ~/railiance-platform`,
   and require both mounted source comparisons true. EnvFrom needs a new process;
   ESO Ready alone is insufficient.
6. Obtain a separately reviewed existing bounded backup/provider receipt before
   declaring activity consumer acceptance. Do not automatically fire schedules.

No image update, worker restart, schedule or provider mutation has occurred.
Current source-owned error-boundary hardening from T06 remains separate; this
packet does not claim it was loaded by the existing image.