From 20da1d3dd46af35159b00e68cefdcfae07b90ba4 Mon Sep 17 00:00:00 2001
From: Codex <codex@geointel.local>
Date: Wed, 22 Jul 2026 03:58:56 +0200
Subject: [PATCH] fix: avoid recursive PostGIS startup ownership rewrite

---
 CHANGELOG.md                                 | 3 +++
 backend/tests/test_rc5_release_deployment.py | 2 ++
 deploy/unraid/all-in-one-start.sh            | 5 ++++-
 docs/CODEX_EXECUTION_LOG.md                  | 3 +++
 4 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72e61ed2..c4be2ea3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,9 @@
   immutable deploy health gate to 16 minutes. This prevents a large persistent
   data directory from being terminated mid-recovery by the former two- and
   three-minute ceilings.
+- Removed the unconditional recursive ownership rewrite of the persistent
+  PostGIS data directory. Startup now changes only the root directory owner;
+  the official PostgreSQL entrypoint retains its targeted ownership checks.
 
 - Made `Belgium and North Sea Workbench` the unconditional frontend startup
   context, moved the initial MapLibre viewport to national extent and removed
diff --git a/backend/tests/test_rc5_release_deployment.py b/backend/tests/test_rc5_release_deployment.py
index 45b61745..885d62dc 100644
--- a/backend/tests/test_rc5_release_deployment.py
+++ b/backend/tests/test_rc5_release_deployment.py
@@ -54,6 +54,8 @@ def test_release_waits_for_large_postgis_volume_recovery() -> None:
     assert "for attempt in $(seq 1 480)" in release_script
     assert "for attempt in $(seq 1 450)" in start_script
     assert "PostGIS did not become ready within 15 minutes." in start_script
+    assert 'chown postgres:postgres "$PGDATA"' in start_script
+    assert 'chown -R postgres:postgres "$PGDATA"' not in start_script
 
 
 def test_runtime_configuration_is_validated_before_container_replacement() -> None:
diff --git a/deploy/unraid/all-in-one-start.sh b/deploy/unraid/all-in-one-start.sh
index e0e19fb3..312ebc18 100644
--- a/deploy/unraid/all-in-one-start.sh
+++ b/deploy/unraid/all-in-one-start.sh
@@ -35,7 +35,10 @@ sed -i "s/__GEOINTEL_MAX_UPLOAD_MB__/${MAX_UPLOAD_MB}/g" /etc/nginx/conf.d/defau
 nginx -t
 
 mkdir -p "$PGDATA" "$STORAGE_ROOT" "$YOLO_CONFIG_DIR" /run/nginx /var/log/nginx
-chown -R postgres:postgres "$PGDATA"
+# The persisted database can contain millions of relation files. A recursive
+# chown on every start rewrites metadata even when ownership is already right,
+# delaying startup and creating avoidable recovery I/O.
+chown postgres:postgres "$PGDATA"
 
 postgres_pid=""
 backend_pid=""
diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md
index 5fdf7121..94bc405c 100644
--- a/docs/CODEX_EXECUTION_LOG.md
+++ b/docs/CODEX_EXECUTION_LOG.md
@@ -3676,6 +3676,9 @@ Validation:
 - A live Tower deploy exposed PostGIS crash recovery exceeding the former
   startup/deploy waits. Raised both bounded waits to 15/16 minutes and added a
   release regression so recovery can finish without a premature rollback.
+- The same live restart exposed an unconditional recursive `chown` over the
+  persistent database. Replaced it with root-directory ownership only to avoid
+  rewriting relation metadata and delaying every all-in-one startup.
 
 This file must be updated by Codex after each implementation pass.