From ab01c93d49c68430fec1329114d18e0ca125b9a8 Mon Sep 17 00:00:00 2001
From: Codex <codex@geointel.local>
Date: Wed, 22 Jul 2026 03:51:45 +0200
Subject: [PATCH] fix: allow bounded PostGIS crash recovery

---
 CHANGELOG.md                                 | 4 ++++
 backend/tests/test_rc5_release_deployment.py | 9 +++++++++
 deploy/unraid/all-in-one-start.sh            | 7 +++++--
 deploy/unraid/deploy-release.sh              | 2 +-
 docs/CODEX_EXECUTION_LOG.md                  | 3 +++
 5 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9955207..72e61ed2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,10 @@
   artifacts require an explicit large-storage partition plan, while the MDK
   endpoint still fails strict hostname validation. Neither is presented as a
   measured analytical layer.
+- Extended the bounded all-in-one PostGIS recovery wait to 15 minutes and the
+  immutable deploy health gate to 16 minutes. This prevents a large persistent
+  data directory from being terminated mid-recovery by the former two- and
+  three-minute ceilings.
 
 - Made `Belgium and North Sea Workbench` the unconditional frontend startup
   context, moved the initial MapLibre viewport to national extent and removed
diff --git a/backend/tests/test_rc5_release_deployment.py b/backend/tests/test_rc5_release_deployment.py
index 81dbe82d..45b61745 100644
--- a/backend/tests/test_rc5_release_deployment.py
+++ b/backend/tests/test_rc5_release_deployment.py
@@ -47,6 +47,15 @@ def test_release_and_container_replacement_are_serialized() -> None:
     assert "GeoIntel container removal did not complete within 60 seconds" in run_script
 
 
+def test_release_waits_for_large_postgis_volume_recovery() -> None:
+    release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
+    start_script = (ROOT / "deploy" / "unraid" / "all-in-one-start.sh").read_text(encoding="utf-8")
+
+    assert "for attempt in $(seq 1 480)" in release_script
+    assert "for attempt in $(seq 1 450)" in start_script
+    assert "PostGIS did not become ready within 15 minutes." in start_script
+
+
 def test_runtime_configuration_is_validated_before_container_replacement() -> None:
     run_script = (ROOT / "deploy" / "unraid" / "run-dockerman-container.sh").read_text(encoding="utf-8")
 
diff --git a/deploy/unraid/all-in-one-start.sh b/deploy/unraid/all-in-one-start.sh
index 413e3f4d..e0e19fb3 100644
--- a/deploy/unraid/all-in-one-start.sh
+++ b/deploy/unraid/all-in-one-start.sh
@@ -56,7 +56,10 @@ echo "Starting embedded PostGIS..."
 postgres_pid="$!"
 
 echo "Waiting for embedded PostGIS..."
-for attempt in $(seq 1 60); do
+# Large persistent PostGIS volumes can require several minutes of crash
+# recovery after an interrupted container replacement. Keep the wait bounded,
+# but do not terminate recovery at the former two-minute ceiling.
+for attempt in $(seq 1 450); do
   if pg_isready -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" >/dev/null 2>&1; then
     echo "PostGIS is ready after attempt ${attempt}."
     break
@@ -69,7 +72,7 @@ for attempt in $(seq 1 60); do
 done
 
 if ! pg_isready -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" >/dev/null 2>&1; then
-  echo "PostGIS did not become ready."
+  echo "PostGIS did not become ready within 15 minutes."
   exit 1
 fi
 
diff --git a/deploy/unraid/deploy-release.sh b/deploy/unraid/deploy-release.sh
index a7c0cb0e..fa80f617 100644
--- a/deploy/unraid/deploy-release.sh
+++ b/deploy/unraid/deploy-release.sh
@@ -46,7 +46,7 @@ FRONTEND_URL="${FRONTEND_URL:-http://127.0.0.1:${GEOINTEL_FRONTEND_PORT:-1202}}"
 
 wait_for_geointel_health() {
   local status=""
-  for attempt in $(seq 1 90); do
+  for attempt in $(seq 1 480); do
     status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' geointel 2>/dev/null || true)"
     if [ "$status" = "healthy" ]; then
       echo "GeoIntel container is healthy after attempt ${attempt}."
diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md
index edb2660e..5fdf7121 100644
--- a/docs/CODEX_EXECUTION_LOG.md
+++ b/docs/CODEX_EXECUTION_LOG.md
@@ -3673,6 +3673,9 @@ Validation:
   prerequisite instead of a fake operational source.
 - Reprobed the documented MDK WCS endpoints. Strict TLS still fails hostname
   validation; acquisition remains disabled and no insecure fallback was added.
+- A live Tower deploy exposed PostGIS crash recovery exceeding the former
+  startup/deploy waits. Raised both bounded waits to 15/16 minutes and added a
+  release regression so recovery can finish without a premature rollback.
 
 This file must be updated by Codex after each implementation pass.