# Local repair review, 2026-10-06

This review adds defensive regressions and source fixes. It does not approve
production or native-dedicated PostgreSQL placement. Target tests ran with no
external network, dummy identities, private scratch storage and resource limits.
No retained runtime, shared service or production resource was changed.

The management routes recheck membership after reading a deferred request body,
before writing function secrets, deployments, sign-in settings or database
passwords. Awaited service logs and metrics also recheck authority before
returning data; viewers retain metrics access but cannot read service logs.
Installation operator routes apply the same check before creating an
organization, changing update settings or requesting an update. A removed or
demoted actor receives a refusal without publishing those changes.

A project move commits ownership only after its source keys are revoked. A key
store failure rolls back ownership, queued jobs, audit and notification rows.
Keys already revoked in their separate store remain revoked; retry can complete
the move. Direct database passwords and internal signing secrets are outside
this revocation operation, as before.

Studio assigns request paths and queries to the configured upstream URL without
interpreting a double slash path as a different host. Existing session-cookie
stripping and service-key authorization still apply.

Legacy offsite fetch requires the decrypted manifest creation timestamp to equal
the requested backup name before publishing the files. A mismatch refuses and
removes the staging files. Import preserves embedded double quotes in extension
and schema identifiers while retaining the existing and inactive exclusions.

Generation migration requires the observed HBA rules to match its inventory
before archival and completion, including retries. An old archive that did not
verify that match cannot authorize completion. An absent retired container has
no supported verified archive route: a new request refuses before publishing
intent, and an existing intent remains a startup barrier. See the
[migration contract](https://github.com/M7MMAD-OMAR/sbarbase/blob/main/docs/engineering/CONTAINER-GENERATION-MIGRATION.md).

These changes have local regression evidence. Native runtime configuration,
interrupted replacement recovery, PostgreSQL image changes, recovery after
failed rollback, database/object backup coherence, capacity calibration and
fresh-host restore remain separate acceptance work. See
[deployment readiness](https://base.sbarah.com/en/docs/reference/deployment-readiness/). Unit tests cannot establish
those outcomes.

The console now shows inline validation for login, invitation creation and
acceptance, names, gateway shares, function secrets and sign-in settings.
Existing login passwords remain exact; new invitation passwords follow the
server's 12 to 256 character policy. Network failures preserve form values and
permit retry. GitHub repository, publisher account and Apache-2.0 links are
visible in authentication screens and console navigation. Screenshot evidence
uses a disposable demo catalog, not live Auth, databases or deployment services.