Record verified Backup account activation and consumer refresh

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

history/2026-09-05-nextcloud-backup-account-cutover.md

@@ -0,0 +1,29 @@
+# Dedicated Nextcloud Backup account activated — 2026-09-05
+
+User authorized replacing Bernd's personal upload lane with the new Backup
+account. Resolved UI custody notation to KVv2 operators/nextcloud/backup
+(BACKUP_USERNAME/BACKUP_PASSWORD). Native WebDAV confirmed Backup and a
+10,737,418,240-byte account quota.
+
+Created /railiance-backups and backup prefix folders, with a Backup-owned public
+share granting create only (permissions 4). Account password remains operator-only.
+An initial publicUpload option broadened the share; verification rejected it and
+removed that share before touching workload custody. Explicit permissions alone
+produced the required grant. The actual file-drop endpoint denies GET and DELETE
+with HTTP 405. Three encrypted synthetic fixtures exercised transport/recovery;
+all were removed using owner authority after verification.
+
+Uploaded with HTTP 201, downloaded as owner, and decrypted with existing age
+escrow. CAS advanced the workload lane from version 2 to 3, changing only the
+upload token and URL. Forced actcore-backup-offsite refresh and compared values
+in protected memory. Restarted actcore-api, actcore-event-router and actcore-worker;
+all ready with new values loaded. No password or token appears in source/evidence.
+
+10 GiB is a hard account limit, not assurance that 14 daily plus four weekly
+backups fit. No retained backup deletion or automatic pruning was performed.
+Existing Bernd-owned backups and recovery access remain where they were.
+T03 is done; T02 remains waiting for old share invalidation and a real offsite
+application restore. Upload rotation does not clear historical age-key exposure.
+
+Validation: 196 repository tests passed. Live evidence is in
+`docs/evidence/RPF-WP-0029-backup-account-2026-09-05.json`.