railiance-platform/history/2026-09-06-backup-problem-followup.md

Backup problem follow-up — 2026-09-06

The attended-login failures were caused by missing Linux browser launchers on this WSL host. The installed Bao browser dependency tries xdg-open, x-www-browser and www-browser; none was installed. The unauthenticated OIDC routing probe returned the expected Keycloak host and localhost callback. Implemented a narrowly validated, repository-scoped Windows browser bridge and retained Warden's contained credential session. The replacement login reached the silent owner command and began the real secondary archive transfer. The 5,353,024,293-byte encrypted archive uploaded with HTTP 201, downloaded with HTTP 200 and matched the source ciphertext hash. Decryption matched the validated source archive hash. Warden exited 0 after its contained session, including its self-revocation/cleanup path. The isolated application recovery is recorded separately below.

Forgejo's native PostgreSQL backup is now active on the primary Scaleway bucket at platform-pg/forgejo-db/, using the existing CCR-2026-0012 backup identity. No IAM expansion or new credential delivery was needed. A resource-version guarded patch changed only the live backup field; source manifests include HTTPS/DNS egress, daily 02:35 UTC base backup, WAL archiving and 30-day retention. The fresh backup completed with production Ready and continuous archiving.

An isolated Scaleway recovery became ready in 45.08 seconds and preserved 142 repository records, six users and 2,040 package blob records. Production remained Ready and the scratch namespace was removed. These are database records, not recovered repository/package files. WP-0038-T01/T02/T03 are done. T04 retains the separate full-archive primary delivery and application recovery contract; WP-0029 retains the secondary incident and predecessor invalidation.

Evidence:

• docs/evidence/forgejo-scaleway-activation-2026-09-06.json
• docs/evidence/forgejo-scaleway-restore-2026-09-06.json

All 204 repository tests passed after the browser fix and generalized primary restore helper. The live primary recovery additionally verified that helper against the new Forgejo Barman destination.

The first two isolated application attempts stopped in database import; both removed their temporary resources. The first did not record a precise failure cause. Increasing the timeout and importing the 97 MB INSERT-based SQL dump in one transaction did not resolve the second attempt's psql connection exit (code 2). Inspection of the pinned PostgreSQL image confirmed its initialization server listens only on a Unix socket and then shuts down. The old socket-based readiness probe could accept that temporary server. Changed readiness to the final TCP listener, then retained trusted local-socket import inside the disposable container. The helper now records fixed failure categories without printing SQL, application rows or captured diagnostics.

The corrected full application recovery PASSED from the actual Nextcloud download. Forgejo started healthy with 142 repository records, six users and 2,040 package blob records. Public repositories coulomb/key-cape and coulomb/adaptive-pricing both cloned over the isolated HTTP endpoint and passed git fsck --full. Every one of the 2,040 stored package blobs matched its database SHA-256 digest. Disposable containers, network and extracted staging were removed. This verifies startup, sampled Git delivery and all blob bytes; it does not claim every package installation workflow, runner recovery, or production failover. All 207 repository tests passed.

Evidence: docs/evidence/RPF-WP-0029-secondary-transfer-2026-09-06.json and docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json.

WP-0029-T02 now retains only the old Bernd-owned share invalidation/custody receipt. Its replacement full-application recovery requirement is satisfied. The exposed recovery-key history remains; upload-account replacement does not clear it. Primary full-archive delivery remains WP-0038-T04.

The exact rejected September 4 drill copy was conditionally deleted by its size and strong ETag after replacement recovery (HTTP 204). Warden exited 0. The temporary fetched plaintext ZIP was removed; good encrypted backups were preserved. Immediate Nextcloud quota metadata still reported 5,234,716,518 bytes free, less than this 5,353,024,293-byte artifact. Do not infer freed quota from DELETE or promise another full upload will fit. Recheck provider quota and agree archive retention/capacity within the existing owner contract. No retained good backup or personal-account share was deleted. Evidence: docs/evidence/RPF-WP-0029-rejected-fixture-cleanup-2026-09-06.json.