Record successful full offsite Forgejo recovery and remaining custody gate

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

history/2026-09-06-backup-problem-followup.md

@@ -7,7 +7,11 @@ routing probe returned the expected Keycloak host and localhost callback.
 Implemented a narrowly validated, repository-scoped Windows browser bridge
 and retained Warden's contained credential session. The replacement login
 reached the silent owner command and began the real secondary archive transfer.
-Transfer and revocation results are recorded separately when complete.
+The 5,353,024,293-byte encrypted archive uploaded with HTTP 201, downloaded
+with HTTP 200 and matched the source ciphertext hash. Decryption matched the
+validated source archive hash. Warden exited 0 after its contained session,
+including its self-revocation/cleanup path. The isolated application recovery
+is recorded separately below.
 
 Forgejo's native PostgreSQL backup is now active on the primary Scaleway bucket
 at `platform-pg/forgejo-db/`, using the existing CCR-2026-0012 backup identity.
@@ -31,3 +35,42 @@ Evidence:
 All 204 repository tests passed after the browser fix and generalized primary
 restore helper. The live primary recovery additionally verified that helper
 against the new Forgejo Barman destination.
+
+The first two isolated application attempts stopped in database import; both
+removed their temporary resources. The first did not record a precise failure
+cause. Increasing the timeout and importing the 97 MB INSERT-based SQL dump
+in one transaction did not resolve the second attempt's psql connection exit
+(code 2). Inspection of the pinned PostgreSQL image confirmed its initialization
+server listens only on a Unix socket and then shuts down. The old socket-based
+readiness probe could accept that temporary server. Changed readiness to the
+final TCP listener, then retained trusted local-socket import inside the
+disposable container. The helper now records fixed failure categories without
+printing SQL, application rows or captured diagnostics.
+
+The corrected full application recovery PASSED from the actual Nextcloud
+download. Forgejo started healthy with 142 repository records, six users and
+2,040 package blob records. Public repositories coulomb/key-cape and
+coulomb/adaptive-pricing both cloned over the isolated HTTP endpoint and passed
+`git fsck --full`. Every one of the 2,040 stored package blobs matched its
+database SHA-256 digest. Disposable containers, network and extracted staging
+were removed. This verifies startup, sampled Git delivery and all blob bytes;
+it does not claim every package installation workflow, runner recovery, or
+production failover. All 207 repository tests passed.
+
+Evidence: `docs/evidence/RPF-WP-0029-secondary-transfer-2026-09-06.json` and
+`docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json`.
+
+WP-0029-T02 now retains only the old Bernd-owned share invalidation/custody
+receipt. Its replacement full-application recovery requirement is satisfied.
+The exposed recovery-key history remains; upload-account replacement does not
+clear it. Primary full-archive delivery remains WP-0038-T04.
+
+The exact rejected September 4 drill copy was conditionally deleted by its
+size and strong ETag after replacement recovery (HTTP 204). Warden exited 0.
+The temporary fetched plaintext ZIP was removed; good encrypted backups were
+preserved. Immediate Nextcloud quota metadata still reported 5,234,716,518
+bytes free, less than this 5,353,024,293-byte artifact. Do not infer freed quota
+from DELETE or promise another full upload will fit. Recheck provider quota and
+agree archive retention/capacity within the existing owner contract. No retained
+good backup or personal-account share was deleted.
+Evidence: `docs/evidence/RPF-WP-0029-rejected-fixture-cleanup-2026-09-06.json`.