M6.5: matrix-synapse (recipe #4) full 3-stage green on host (postgres-marker DB-hook); Drone #51 in flight

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -84,8 +84,12 @@ Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adver
       (handles cryptpad's SANDBOX_DOMAIN). Fixed a real backup bug en route: set_env glued
       RESTIC_REPOSITORY onto a comment → backupbot had no restic repo (now newline-safe). Drone
       canonical run = **build #46 success** (~6m, all 3 stages green, clean teardown).
-- [ ] Enroll recipes 4–6 covering remaining D10 categories (multi-service+S3, large-volume,
-      TLS-passthrough), no harness surgery
+- [x] matrix-synapse (DB+media/large-volume, recipe #4) full 3-stage green on host: install 2✓
+      (client API + versions JSON), upgrade 1✓ (postgres marker survives), backup 1✓ — exercises the
+      recipe's pg_backup.sh DB-dump hook (not a plain volume copy). No harness surgery. Drone
+      canonical run = build #51 (in flight).
+- [ ] Enroll recipes 5–6: multi-service+S3 (lasuite-docs) + TLS-passthrough (bluesky-pds),
+      no harness surgery
 - [ ] Re-verify keycloak backup post set_env fix (build #39 ran off an earlier backupbot deploy)
 - [ ] Gate: M6.5 — recipes 3–6 three-stage green
 

JOURNAL.md

@@ -571,3 +571,20 @@ backupbot container has `RESTIC_REPOSITORY=/backups/restic`, and cryptpad backup
 passes. NOTE: keycloak backup (build #39) passed off an *earlier, non-corrupted* backupbot deploy;
 worth a re-verify, but the mechanism is now correct/reproducible. Triggered Drone build #46 (cryptpad)
 as the canonical recipe-ci run.
+
+---
+## 2026-05-27 — M6.5: matrix-synapse (recipe #4, DB+media/large-volume) full 3-stage green
+
+Enrolled matrix-synapse (synapse `app` + postgres `db` + nginx `web`) — the large-volume/DB+media
+D10 category. No harness surgery (server_name = DOMAIN; no EXTRA_ENV needed). Host runs (cc-ci-run):
+install **2 passed** (~2.7m; client API 200 + real `/_matrix/client/versions` JSON), upgrade
+**1 passed** (~2.3m; postgres marker survives previous→current), backup **1 passed** (~1.5m). Clean
+teardown (0 matr services). The data-survival tests use a `ci_marker` postgres row exec'd via
+`psql` in the `db` service — this exercises the recipe's real DB-dump backup hook
+(`backupbot.backup.pre-hook=/pg_backup.sh backup` / `restore.post-hook`), the meaningful matrix data
+path (not a plain volume copy). Worked first try (the set_env/RESTIC fix holds for hook-based
+backups too). Triggering the canonical Drone recipe-ci run.
+
+4 of 6 D10 recipes now green: custom-html (simple), keycloak (SSO/DB), cryptpad (stateful/no-DB),
+matrix-synapse (DB+media/large-volume). Remaining categories: multi-service+S3 (lasuite-docs) and
+TLS-passthrough (bluesky-pds).