Record successful full offsite Forgejo recovery and remaining custody gate

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/README.md

@@ -8,7 +8,7 @@ plans is not a count of missing implementations or independent incidents.
 | Workplan | Purpose and next gate | S3 boundary |
 | --- | --- | --- |
 | [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. |
-| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup account cutover complete; old share invalidation and full offsite application restore remain | S3 retains custody acceptance; S1 and forge own their backup execution. |
+| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup cutover and full offsite application recovery complete; old share invalidation receipt remains | S3 retains custody acceptance; S1 and forge own their backup execution. |
 | [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
 | [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; registered load driver exists; fresh sender/window/abort approvals and custody readiness remain | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
 | [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Two remaining lanes: secrets-engine JWT and Fluid operator KV | Signing T04 is complete; JWT and Fluid retain separate issuer/consumer gates. |

workplans/RPF-WP-0029-backup-credential-default-removal.md

@@ -7,7 +7,7 @@ repo: railiance-platform
 status: blocked
 owner: codex
 created: "2026-09-05"
-updated: "2026-09-05"
+updated: "2026-09-06"
 state_hub_workstream_id: "bb326ebb-a313-549e-b35f-1bf17e1c58fd"
 ---
 
@@ -45,11 +45,13 @@ Provider-side invalidation and replacement custody need the attended provider ow
 
 Prepared owner execution procedure: `docs/backup-credential-recovery.md`.
 The dedicated Backup account cutover is complete under T03. Awaiting owner
-authority for invalidating the old Bernd-owned share and a real offsite restore. Activity-core is
+authority for invalidating the old Bernd-owned share. Full offsite application
+recovery passed on September 6 (evidence below). Activity-core is
 also a consumer of this upload lane. Preserve AGE_PRIVATE_KEY and historical
 exposure evidence; upload-token rotation cannot clear recovery-key taint.
-T03 proves encrypted fixture transport and decryption; full application restore
-and historical predecessor invalidation remain open.
+T03 proves encrypted fixture transport and decryption; September 6 evidence
+also proves full application recovery. Historical predecessor invalidation
+remains open.
 
 ## Portfolio review — 2026-09-05
 
@@ -128,3 +130,30 @@ Barman destination and the Forgejo full-archive uploader still targets Nextcloud
 Do not conflate this coverage gap with the old-share incident or silently move
 archives into a database-owned prefix. WP-0029's secondary acceptance gates
 remain explicit. Source/platform assurance records now name the correct primary.
+
+
+## Follow-up — 2026-09-06
+
+Repaired the missing WSL browser-launcher path while retaining Warden
+containment. Fresh attended login reached the owner command, the full verified
+5.35 GB archive uploaded to Backup (201), downloaded (200), matched ciphertext
+and decrypted archive hashes, and Warden exited 0 after session cleanup.
+Evidence: `docs/evidence/RPF-WP-0029-secondary-transfer-2026-09-06.json`.
+Application recovery and predecessor invalidation remain separate gates.
+
+The earlier primary gap observation is superseded for forgejo-db: native
+Scaleway base backup/WAL and isolated database recovery now pass under
+RPF-WP-0038-T02/T03. Forgejo's primary full-archive delivery remains T04.
+The Backup account's 10 GiB quota holds only about two current full archives;
+growth and other consumers require a bounded retention policy, not automatic
+deletion of retained backups.
+
+Replacement recovery PASSED: isolated Forgejo healthy, 142 repositories, six
+users, two public Git clones plus fsck, and all 2,040 package blob digests
+verified. Disposable resources removed. Evidence:
+`docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json`.
+T02 remains `wait` solely for the Bernd-owned predecessor invalidation/custody
+receipt; do not repeat the completed replacement restore as an open gate.
+
+Rejected drill-copy cleanup completed with conditional DELETE 204; attended
+session exited 0. Temporary plaintext removed; good encrypted backups retained.

workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md

@@ -83,3 +83,9 @@ The existing 5.35 GB encrypted verified archive is available in private staging.
 Keep Nextcloud's 10 GiB secondary budget separate. The current helper still
 uploads only to Nextcloud until this task's full delivery is implemented and
 verified; native database backup alone cannot close the workplan.
+
+Secondary capacity observation (not a native-primary acceptance gate): after
+the successful full recovery and rejected-fixture DELETE, immediate Nextcloud
+metadata still reported 5,234,716,518 free bytes, below one current archive's
+5,353,024,293 bytes. Recheck quota and settle bounded archive retention/capacity
+with the owning package; do not automatically delete retained good backups.