feat: complete WP-0002 T05 full restore and PITR

First Backup 48s. Full restore 65s (audit_core 30=30). PITR 65s
after retarget (keep present, destroy absent). Scratch namespace
deleted. Production stayed Ready.

data/reefs/reef-storage.json

@@ -10,7 +10,7 @@
     {"resource_id": "resource:platform:audit-storage", "role": "object_store"}
   ],
   "consumers_potential": ["rapp-postgres"],
-  "consumers_actual": [],
+  "consumers_actual": ["rapp-postgres"],
   "notes": [
     "Provider-delegated S3 (Scaleway). No rail.",
     "Attribute values: reef:storage/substrate/object-stores/platform-audit-storage.yaml",

data/resources/platform-audit-storage.json

@@ -33,7 +33,7 @@
   ],
   "consumers": {
     "potential": ["rapp-postgres"],
-    "actual": []
+    "actual": ["rapp-postgres"]
   },
   "resource_class": "storage",
   "status": "ordered",

docs/evidence/RESOURCE-WP-0002-T05-restore-2026-08-14.json

@@ -0,0 +1,55 @@
+{
+  "workplan": "RESOURCE-WP-0002-T05",
+  "recorded_at": "2026-08-14T18:24:00Z",
+  "mode": "production-s3",
+  "target": "CNPG 1.25 / PostgreSQL 16.10 platform-pg on railiance01",
+  "object_store": "s3://railiance-platform-pg-backup/platform-pg/ via https://s3.nl-ams.scw.cloud",
+  "production_backup": "enabled; Backup platform-pg-daily-20260814181421 completed; ContinuousArchivingSuccess",
+  "retention_policy": "30d",
+  "single_consumer_restore": "physical restore is instance-wide; consumer counts compared on scratch clusters",
+  "source": {
+    "databases": ["audit_core", "isolation_probe", "platform_meta", "postgres"],
+    "audit_core_events": 30,
+    "events_append_only": 1,
+    "pgdata_bytes_approx": 636485632
+  },
+  "first_backup": {
+    "name": "platform-pg-daily-20260814181421",
+    "elapsed_seconds": 48,
+    "method": "barmanObjectStore",
+    "verified": true
+  },
+  "full_restore": {
+    "cluster": "platform-pg-restore-full",
+    "namespace": "platform-pg-restore",
+    "started_at": "2026-08-14T18:15:23Z",
+    "ready_at": "2026-08-14T18:16:28Z",
+    "elapsed_seconds": 65,
+    "audit_core_events": 30,
+    "events_append_only": 1,
+    "isolation_ns": 2,
+    "verified": true
+  },
+  "pitr": {
+    "cluster": "platform-pg-restore-pitr",
+    "namespace": "platform-pg-restore",
+    "keep_at": "2026-08-14 18:16:54.128693+00",
+    "destroy_at": "2026-08-14 18:17:11.932371+00",
+    "target_time": "2026-08-14 18:16:55.128693+00",
+    "started_at": "2026-08-14T18:22:06Z",
+    "ready_at": "2026-08-14T18:23:11Z",
+    "elapsed_seconds": 65,
+    "markers": "keep",
+    "audit_core_events": 30,
+    "first_attempt": "failed: recovery ended before target 18:17:08 (WAL last txn 18:16:54); retargeted to 18:16:55",
+    "verified": true
+  },
+  "archive": {
+    "objects": 8,
+    "bytes": 6604031,
+    "prefix": "platform-pg/"
+  },
+  "rpo_notes": "archive_timeout is 5min; observed WAL archive after pg_switch_wal in about 2s",
+  "provider_charges": "unknown this session; Scaleway usage-based, billing API denied to this key",
+  "failures": 0
+}

docs/evidence/RESOURCE-WP-0002-T05-restore-2026-08-14.md

@@ -0,0 +1,52 @@
+# RESOURCE-WP-0002 T05 — production Barman restore evidence
+
+Date: 2026-08-14  
+Status: **verified**  
+JSON: `docs/evidence/RESOURCE-WP-0002-T05-restore-2026-08-14.json`
+
+## What was enabled
+
+- `platform-pg` `spec.backup.barmanObjectStore` →
+  `s3://railiance-platform-pg-backup/platform-pg/`
+- ScheduledBackup `platform-pg-daily` (`immediate: true`, 02:15 UTC)
+- First Backup `platform-pg-daily-20260814181421` completed in 48s
+- ContinuousArchivingSuccess; WAL uploaded with `barman-cloud-wal-archive`
+
+## Full restore
+
+Scratch cluster `platform-pg-restore-full` in namespace `platform-pg-restore`
+(not `databases`). Ready in 65s.
+
+| Check | Production | Scratch |
+| --- | --- | --- |
+| `audit_core.events` | 30 | 30 |
+| `events_append_only` | 1 | 1 |
+| isolation non-system schemas | 2 | 2 |
+
+Restore also showed a leftover `app` database (7.9 MB) that production
+does not list. Consumer databases matched. Not recovered in place.
+
+## PITR
+
+Markers written only in `platform_meta.t05_restore_probe` on production
+(`keep` then `destroy`), then dropped after evidence.
+
+- `keep` at 18:16:54.128693+00
+- `destroy` at 18:17:11.932371+00
+- First target 18:17:08 failed: PostgreSQL stopped redo at last
+  completed txn 18:16:54 (`recovery ended before configured recovery
+  target was reached`).
+- Retarget 18:16:55.128693+00 succeeded in 65s. Scratch table had
+  `keep` only. `audit_core.events` still 30.
+
+## Archive
+
+8 objects, 6 604 031 bytes under `platform-pg/` after the first backup
+and WAL switches.
+
+Provider charges this session: unknown (billing API denied).
+
+## Cleanup
+
+Scratch namespace `platform-pg-restore` deleted after this file was
+written. Production cluster remained Ready. Probe table dropped.

workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md

@@ -269,7 +269,7 @@ has no `barmanObjectStore`. WAL remains T05.
 
 ```task
 id: RESOURCE-WP-0002-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02"
 ```
@@ -288,6 +288,12 @@ backup age, object growth, retention behavior, and alerts. Then:
 Done when both restores are verified and timed. A successful upload alone is
 not backup acceptance.
 
+Done 2026-08-14: first Backup completed in 48s; full restore 65s
+(`audit_core.events` 30=30); PITR 65s after retarget (`keep` present,
+`destroy` absent). Evidence
+`docs/evidence/RESOURCE-WP-0002-T05-restore-2026-08-14.json`. Scratch
+namespace deleted. Production stayed Ready.
+
 ## T06 — Establish the independent logical-copy lane
 
 ```task