Package private chat for HTTPS and verify portable encrypted recovery

1 files changed, 21 insertions, 7 deletions

diff --git a/docs/OPERATIONS.txt b/docs/OPERATIONS.txt
index 2cf4693..a2534b6 100644
--- a/docs/OPERATIONS.txt
+++ b/docs/OPERATIONS.txt
@@ -103,8 +103,11 @@ EXPORT AND BACK UP PRODUCTION
         cd ~/stack
         ./bin/stack backup --include-images
 
-    The command briefly pauses the three services while copying consistent
+    The command briefly pauses Caddy, cgit, and SearXNG while copying their
     application files, then resumes them before compression and encryption.
+    Chat remains unpaused so SQLite online backups can complete during active
+    writes. Consistent snapshots cover both chat and chat-local databases; raw
+    SQLite journals and server lock files are excluded.
     It uses the published public key, verifies the recipient fingerprint,
     checks bare Git repositories, saves exact images, and produces:
 
@@ -261,8 +264,9 @@ MAKE AND DEPLOY A RELEASE
         cd ~/stack
         cargo stack release
 
-    Release reruns the full check, builds a static Rust binary locally,
-    builds the cgit container locally, and packages the configured image set.
+    Release reruns the full check, builds static Rust management and chat
+    binaries plus the browser WASM module, packages corresponding sources,
+    builds cgit/chat containers locally, and saves the configured image set.
     Outputs are dist/stack-release-TIMESTAMP.tar.gz and its .sha256 file.
     No .env, live data, .git history, or previous backup is included.
 
@@ -291,8 +295,16 @@ MAKE AND DEPLOY A RELEASE
         cd ~/stack/var/incoming
         sha256sum -c stack-release-TIMESTAMP.tar.gz.sha256
         cd ~/stack
-        ./bin/stack activate var/incoming/stack-release-TIMESTAMP.tar.gz
+        mkdir -p var/incoming/bootstrap
+        tar -xzf var/incoming/stack-release-TIMESTAMP.tar.gz -C var/incoming/bootstrap stack/bin/stack
+        var/incoming/bootstrap/stack/bin/stack --root "$PWD" activate var/incoming/stack-release-TIMESTAMP.tar.gz
         ./bin/stack status
+        rm -rf -- var/incoming/bootstrap
+
+    Use the management binary from the verified new release for activation.
+    Older binaries can reject a new service schema before installing it. This
+    bootstrap path handles the upgrade from three services to the chat-enabled
+    release without installing a compiler or overwriting private configuration.
 
     Activation verifies the release and platform, replaces public source and
     the binary, loads exact images, preserves .env and var/data, and replaces
@@ -310,9 +322,11 @@ RECOVERY LIMITS AND SECRET ROTATION
     Changing CPU architecture requires a native release build. Registry access
     is needed only when images are omitted or rebuilding for another target.
 
-    Current persistent state is files, Git repositories, and Caddy state.
-    When adding a database, add its supported flush/dump procedure to the
-    export workflow and test recovery before relying on that database's backup.
+    Current persistent state includes files, Git repositories, Caddy state,
+    and encrypted chat records in SQLite. Chat uses the SQLite online backup
+    API; recovery testing must reopen both participants' unchanged identity
+    files and decrypt history. See CHAT-PRODUCTION.txt for this release's tests.
+    Future databases need their own supported snapshot and recovery procedure.
 
     If changing the OpenPGP backup recipient, publish its public key, update
     the command's default fingerprint, and test encryption and restoration.