fix: avoid recursive PostGIS startup ownership rewrite

CHANGELOG.md

@@ -26,6 +26,9 @@
   immutable deploy health gate to 16 minutes. This prevents a large persistent
   data directory from being terminated mid-recovery by the former two- and
   three-minute ceilings.
+- Removed the unconditional recursive ownership rewrite of the persistent
+  PostGIS data directory. Startup now changes only the root directory owner;
+  the official PostgreSQL entrypoint retains its targeted ownership checks.
 
 - Made `Belgium and North Sea Workbench` the unconditional frontend startup
   context, moved the initial MapLibre viewport to national extent and removed

backend/tests/test_rc5_release_deployment.py

@@ -54,6 +54,8 @@ def test_release_waits_for_large_postgis_volume_recovery() -> None:
     assert "for attempt in $(seq 1 480)" in release_script
     assert "for attempt in $(seq 1 450)" in start_script
     assert "PostGIS did not become ready within 15 minutes." in start_script
+    assert 'chown postgres:postgres "$PGDATA"' in start_script
+    assert 'chown -R postgres:postgres "$PGDATA"' not in start_script
 
 
 def test_runtime_configuration_is_validated_before_container_replacement() -> None:

deploy/unraid/all-in-one-start.sh

@@ -35,7 +35,10 @@ sed -i "s/__GEOINTEL_MAX_UPLOAD_MB__/${MAX_UPLOAD_MB}/g" /etc/nginx/conf.d/defau
 nginx -t
 
 mkdir -p "$PGDATA" "$STORAGE_ROOT" "$YOLO_CONFIG_DIR" /run/nginx /var/log/nginx
-chown -R postgres:postgres "$PGDATA"
+# The persisted database can contain millions of relation files. A recursive
+# chown on every start rewrites metadata even when ownership is already right,
+# delaying startup and creating avoidable recovery I/O.
+chown postgres:postgres "$PGDATA"
 
 postgres_pid=""
 backend_pid=""

docs/CODEX_EXECUTION_LOG.md

@@ -3676,6 +3676,9 @@ Validation:
 - A live Tower deploy exposed PostGIS crash recovery exceeding the former
   startup/deploy waits. Raised both bounded waits to 15/16 minutes and added a
   release regression so recovery can finish without a premature rollback.
+- The same live restart exposed an unconditional recursive `chown` over the
+  persistent database. Replaced it with root-directory ownership only to avoid
+  rewriting relation metadata and delaying every all-in-one startup.
 
 This file must be updated by Codex after each implementation pass.