# RESOURCE-WP-0002 T06 — independent logical-copy lane

Date: 2026-08-14  
Status: **verified**  
Lane: existing governed Nextcloud + age (`CCR-2026-0004`), not Host Europe Backup Storage

## Why this lane

Scaleway holds WAL and base backups under one key. A second copy that is
not S3 and not that key keeps `audit_core` recoverable if the object
store or its credential is lost. Physical restore stays instance-wide;
this path is per-database.

## What was uploaded

Prefix `r01-platform-pg/` on the Option A Nextcloud file drop:

| Artifact | Local size |
| --- | --- |
| `platform-pg-audit_core-20260814T184337Z.dump.age` | 16313 B |
| `platform-pg-platform_meta-20260814T184337Z.dump.age` | 1090 B |
| `platform-pg-isolation_probe-20260814T184337Z.dump.age` | 2618 B |

Encrypt: `age` with the standing Railiance backup public key. Credentials
from `platform/workloads/railiance/backup/offsite-lane`. Values not printed.

Operator commands: `make postgres-logical-offsite-backup` and
`make postgres-logical-offsite-restore-drill` in `rapp-postgres`.
Fleet inventory: `cnpg-option-a-backup` target `r01-platform-pg`.

## Restore drill

Decrypted the `audit_core` artifact (not a Scaleway GET) into a disposable
`postgres:16` pod in namespace `platform-pg-logical`.

| Check | Production | Scratch |
| --- | --- | --- |
| `audit_core.events` | 30 | 30 |
| `events_append_only` | 1 | 1 |

Scratch namespace deleted after the check. Production `platform-pg` was
not modified.

## Residual

Schedule the dump (daily cron, same shape as Forgejo Option A) when an
operator wants it unattended. One successful upload + restore is the
T06 acceptance gate.