docs: capture Core Hub relocation preflight

workplans/CORE-WP-0011-railiance01-production-relocation.md

@@ -45,7 +45,7 @@ evidence. Do not make runtime absorption into hub-core a prerequisite.
 
 ```task
 id: CORE-WP-0011-T01
-status: progress
+status: done
 priority: high
 ```
 
@@ -74,15 +74,18 @@ Forgejo on 2026-08-20. The only remaining Gitea image reference is historical
 evidence in finished `CORE-WP-0004`; confirm the live source Deployment image
 and digest before declaring the dependency closed.
 
-An attended source-cluster inventory remains required. On 2026-08-20 the
-CoulombCore kubeconfig pointed at the documented local API port `16443`, but
-the tunnel was down; the current ops-bridge config no longer contains
-`k3s-api-coulombcore`. The sanctioned warden signer route was followed, but its
-credential broker requires an operator-held OpenBao issuer login unavailable
-to this non-interactive session. No alternate credential path was attempted.
-After operator login, collect metadata-only Deployment/Service/Ingress, image
-digest, Secret names and keys (never values), database target, resource policy,
-and Helm revision evidence before closing this task.
+Completed after the documented local API tunnel proved stale: existing direct
+SSH access provided a metadata-only `kubectl`/Helm path without retrieving a
+new credential. Production is Ready on CoulombCore Kubernetes `v1.30.3+k3s1`,
+Helm chart `0.1.0`, using mutable tag `a33191a` whose pulled image ID is
+`sha256:5e1334eb25975b5f7792d2ae9289898586224133896c6aa55bd27cdc776fb10c`.
+It has one combined environment Secret, empty security contexts, the default
+ServiceAccount and no NetworkPolicies. Health/readiness pass publicly. Helm
+reports release revision 1 while the Deployment reports revision 2, so source
+rollback must retain the actual Deployment/ReplicaSet state rather than rely on
+Helm history alone. Secret inspection recorded key names and byte sizes only;
+no value was read. Full evidence and the target-package diff are in
+`docs/evidence/core-hub-coulombcore-inventory-2026-08-20.md`.
 
 ## Build the relocatable application package
 
@@ -134,7 +137,7 @@ that this workstation is not the production workplan-UUID registrar.
 
 ```task
 id: CORE-WP-0011-T03
-status: todo
+status: wait
 priority: high
 ```
 
@@ -147,6 +150,15 @@ the private target endpoint.
 Done when the shadow runtime is healthy, data reconciliation is repeatable,
 and ops-hub plus activity-core smokes pass against railiance01.
 
+Preflight completed 2026-08-20 without applying resources. ESO CRDs and the
+working audit-core two-store pattern exist on railiance01, but the `core-hub`
+namespace, Core Hub ClusterSecretStores, projected Secrets, and accepted
+`rapp-postgres` consumer declaration do not. The exact target image digest
+pulls and imports Core Hub, Uvicorn, and Alembic under UID/GID 10001 with a
+read-only root filesystem. Package tests, family validation and server dry-run
+pass. This task is `wait` on `RPF-WP-0021-T02/T04`; do not substitute placeholder
+Secrets or a standing database password.
+
 ## Cut over production traffic
 
 ```task
@@ -180,7 +192,7 @@ this repo unless the separate absorption workplan has also completed.
 
 ## Acceptance
 
-- [ ] Decommission deadline and live source/target inventory are recorded
+- [x] Decommission deadline and live source/target inventory are recorded
 - [x] Governed rapp package renders and passes policy checks
 - [ ] Shadow restore/reconciliation and consumer smokes pass on railiance01
 - [ ] Production traffic and tunnel move with explicit approval and rollback