From c879164af6aa3a3aa96271e6dacde369263d6129 Mon Sep 17 00:00:00 2001
From: Ben Stull <ben.stull@wiggleverse.org>
Date: Fri, 12 Jun 2026 01:25:43 -0700
Subject: [PATCH] update
 engineering/0023/SESSION-0023.0-TRANSCRIPT-2026-06-12T01-19--INPROGRESS.md

---
 ...TRANSCRIPT-2026-06-12T01-19--INPROGRESS.md | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/engineering/0023/SESSION-0023.0-TRANSCRIPT-2026-06-12T01-19--INPROGRESS.md b/engineering/0023/SESSION-0023.0-TRANSCRIPT-2026-06-12T01-19--INPROGRESS.md
index d22deb5..a722cda 100644
--- a/engineering/0023/SESSION-0023.0-TRANSCRIPT-2026-06-12T01-19--INPROGRESS.md
+++ b/engineering/0023/SESSION-0023.0-TRANSCRIPT-2026-06-12T01-19--INPROGRESS.md
@@ -18,8 +18,50 @@ Resume stored goal (/goal next): gitea-forge-backups SLICE-5 — off-VM freshnes
 
 ```
 
+## Plan
+
+> Anchor: design `specs/gitea-forge-backups.md` (graduated Solution Design, engineering#30) — ELIGIBLE (R2a).
+> Goal (`/goal next`): gitea-forge-backups SLICE-5 freshness alert + fix the broken marker-refresh path.
+
+**Diagnosis (marker bug):** `markers/last-success.json` froze at the FIRST live run
+(2026-06-11T04:46Z) while 4-hourly dumps keep landing. Root cause: the VM SA holds
+only `roles/storage.objectCreator` (`storage.objects.create`), which **cannot
+overwrite an existing live object**. Dumps use unique names → fresh create → OK.
+The marker uses a FIXED name → every run after the first is an overwrite → 403 →
+marker never refreshes; the job exits non-zero *after* the dump uploaded. Fix must
+NOT grant `objects.delete` (would let a compromised VM destroy backups — breaks
+§6.6/R-4 least-privilege). Correct fix = unique-named per-run markers (always a
+create), freshness keyed off newest-object age.
+
+**Increment 1 — Marker-refresh fix (PR A):**
+1. `infra/gitea-backup/gitea-backup.sh`: write the marker under a per-run name
+   (`markers/last-success-<ts>.json`) — always a create; also keep richer fields.
+2. Spec §6.3/§6.4 data-model wording (marker key is per-run; newest-object age is
+   the primary freshness signal) + changelog bump.
+3. DOC-2 (`infra/deploy-gitea-on-gcp.md`) backups section update.
+4. Re-install on the live forge VM; run the service manually; verify a fresh marker
+   lands and a 2nd run refreshes (the create-not-overwrite proof).
+
+**Increment 2 — SLICE-5 freshness checker (PR B):**
+1. Checker (Cloud Run job/Function, project `wiggleverse`, config `gitea`): list
+   newest `gitea-dump-*.zip`, compute age, emit signal.
+2. Alert delivery = Cloud Monitoring-native (no new secrets): custom metric +
+   alert policy → email notification channel; off-VM dead-man's-switch.
+3. Provision by hand (bootstrap infra, D-6 — NOT flotilla): Scheduler + checker +
+   notification channel + alert policy.
+4. T-3 green against scratch bucket (stale → fires; fresh → quiet) before live.
+5. Finalize RB-3/RB-4 in `infra/backup-restore-gitea.md`; DOC-2 update; spec
+   SLICE-5 done + changelog.
+
 ## Deferred decisions
 
 _Autonomous-mode low-confidence calls the driver made and would have
 liked operator input on. Appended as the session runs; surfaced at
 finalize. Empty if none._
+
+- **Marker fix shape (medium-high confidence):** chose unique-named per-run markers
+  over (a) granting `objects.delete` — rejected, breaks the §6.6/R-4 "VM can create
+  but not delete" security invariant — or (b) dropping the marker entirely and
+  keying only off newest-dump age. Per-run markers keep the spec's TEL-1 marker
+  artifact refreshing within least-privilege. Small spec data-model wording update
+  follows; flagging in case the operator prefers a fixed canonical pointer.