fix: allow bounded PostGIS crash recovery

CHANGELOG.md

@@ -22,6 +22,10 @@
   artifacts require an explicit large-storage partition plan, while the MDK
   endpoint still fails strict hostname validation. Neither is presented as a
   measured analytical layer.
+- Extended the bounded all-in-one PostGIS recovery wait to 15 minutes and the
+  immutable deploy health gate to 16 minutes. This prevents a large persistent
+  data directory from being terminated mid-recovery by the former two- and
+  three-minute ceilings.
 
 - Made `Belgium and North Sea Workbench` the unconditional frontend startup
   context, moved the initial MapLibre viewport to national extent and removed

backend/tests/test_rc5_release_deployment.py

@@ -47,6 +47,15 @@ def test_release_and_container_replacement_are_serialized() -> None:
     assert "GeoIntel container removal did not complete within 60 seconds" in run_script
 
 
+def test_release_waits_for_large_postgis_volume_recovery() -> None:
+    release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
+    start_script = (ROOT / "deploy" / "unraid" / "all-in-one-start.sh").read_text(encoding="utf-8")
+
+    assert "for attempt in $(seq 1 480)" in release_script
+    assert "for attempt in $(seq 1 450)" in start_script
+    assert "PostGIS did not become ready within 15 minutes." in start_script
+
+
 def test_runtime_configuration_is_validated_before_container_replacement() -> None:
     run_script = (ROOT / "deploy" / "unraid" / "run-dockerman-container.sh").read_text(encoding="utf-8")
 

deploy/unraid/all-in-one-start.sh

@@ -56,7 +56,10 @@ echo "Starting embedded PostGIS..."
 postgres_pid="$!"
 
 echo "Waiting for embedded PostGIS..."
-for attempt in $(seq 1 60); do
+# Large persistent PostGIS volumes can require several minutes of crash
+# recovery after an interrupted container replacement. Keep the wait bounded,
+# but do not terminate recovery at the former two-minute ceiling.
+for attempt in $(seq 1 450); do
   if pg_isready -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" >/dev/null 2>&1; then
     echo "PostGIS is ready after attempt ${attempt}."
     break
@@ -69,7 +72,7 @@ for attempt in $(seq 1 60); do
 done
 
 if ! pg_isready -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" >/dev/null 2>&1; then
-  echo "PostGIS did not become ready."
+  echo "PostGIS did not become ready within 15 minutes."
   exit 1
 fi
 

deploy/unraid/deploy-release.sh

@@ -46,7 +46,7 @@ FRONTEND_URL="${FRONTEND_URL:-http://127.0.0.1:${GEOINTEL_FRONTEND_PORT:-1202}}"
 
 wait_for_geointel_health() {
   local status=""
-  for attempt in $(seq 1 90); do
+  for attempt in $(seq 1 480); do
     status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' geointel 2>/dev/null || true)"
     if [ "$status" = "healthy" ]; then
       echo "GeoIntel container is healthy after attempt ${attempt}."

docs/CODEX_EXECUTION_LOG.md

@@ -3673,6 +3673,9 @@ Validation:
   prerequisite instead of a fake operational source.
 - Reprobed the documented MDK WCS endpoints. Strict TLS still fails hostname
   validation; acquisition remains disabled and no insecure fallback was added.
+- A live Tower deploy exposed PostGIS crash recovery exceeding the former
+  startup/deploy waits. Raised both bounded waits to 15/16 minutes and added a
+  release regression so recovery can finish without a premature rollback.
 
 This file must be updated by Codex after each implementation pass.