railiance-platform/workplans/RPF-WP-0028-durable-live-image-inventory.md

---
id: RPF-WP-0028
type: workplan
title: "Make Forgejo image protection survive checkout replacement"
domain: financials
repo: railiance-platform
status: blocked
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
state_hub_workstream_id: "622d1208-b085-5ec2-9fb7-5e41f23e1843"
---

# Make Forgejo image protection survive checkout replacement

Source: State Hub message `868a2326-cdad-4256-be4c-7cd6c8ec4b5b`. Reviewed against current repository state
on 2026-09-05. Repository implementation is complete; live closure remains pending.

## Implement and verify durable publication

```task
id: RPF-WP-0028-T01
status: done
priority: high
state_hub_task_id: "869d4114-3642-5e69-88d1-1d14e5547634"
```

Implemented scripts/refresh_live_images.py and make live-images-refresh. Publication validates exports before mutation, locks concurrent writers, retains all previous cluster entries, and fsyncs an atomic replacement. Offline tests prove repeatability, multi-cluster retention, and preservation on missing, empty, or malformed input.

The local prune CLI was additionally hardened on 2026-09-05 to refuse apply
before credential lookup if any explicitly requested export is missing,
unreadable, empty, or comment-only. Regression coverage includes a valid file
alongside a bad one, proving partial coverage cannot authorize deletion.

## Install production projection and rollout refresh

```task
id: RPF-WP-0028-T02
status: wait
priority: high
state_hub_task_id: "2d0795ba-ccc0-5ba9-8315-2deb4d0d71a6"
```

Requires the production host inventory, activity-core directory mount/configuration update, and cluster rollout hook adoption. Follow docs/forgejo-package-prune.md. Preserve the restored union and worker refusal on missing/empty inventory; do not manually trigger prune. No production migration or live verification occurred in this session.