docs: close private shadow rehearsal

docs/deployment/railiance01-shadow-runbook.md

@@ -6,7 +6,12 @@ stops before public Ingress, DNS, tunnel changes, a final write freeze, or any
 CoulombCore teardown.
 
 Authoritative deploy input: `/home/worsch/rapp-core-hub` at or after package
-commit `03effc8`, chart `0.3.0`.
+commit `7cfa8bb`, chart `0.3.1`.
+
+The private-shadow rehearsal completed on 2026-08-21. The procedure below is
+retained for repeatability and rollback; completion evidence is in
+`docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md`. It still
+does not authorize public cutover.
 
 ## 1. Admission gates
 

docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md

@@ -0,0 +1,53 @@
+# Core Hub railiance01 private-shadow completion — 2026-08-21
+
+## Result
+
+The private Core Hub shadow is healthy on railiance01 and the rehearsal gate
+`CORE-WP-0011-T03` is complete. Public Ingress remains absent. Production
+traffic, DNS, the ops-bridge tunnel, the CoulombCore writer, and the source
+runtime were not changed or retired.
+
+The platform-owned detailed evidence is
+`/home/worsch/railiance-platform/docs/evidence/core-hub-private-shadow-2026-08-21.md`
+at railiance-platform commit `1206ed5`.
+
+## Data reconciliation
+
+- A consistent logical archive was captured from the live source at
+  `2026-08-20 22:12:26 UTC`; its SHA-256 is
+  `3770946a1032c4109fea32fc00f4411c2f4d9311a28fb17bfc3d0d2de888db8b`.
+- Source and restored target matched at Alembic revision `20260627_0002`,
+  eight tables and 39 rows before shadow smoke activity.
+- The source archive's `public` tables were moved explicitly into the accepted
+  target `core_hub` schema. Ownership, migration-role membership and runtime
+  SELECT grants were verified.
+- Later target counts differ only by the protected write operations performed
+  by the successful shadow smokes; this target remains a rehearsal copy, not
+  the production writer.
+
+## Runtime and credential proof
+
+- Helm release revision 2 runs `rapp-core-hub` chart `0.3.1`, package commit
+  `7cfa8bb`, at immutable image digest
+  `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`.
+- The migration Job completed and the Deployment, Service, three governed
+  Secret projections and three NetworkPolicies are healthy; no Ingress exists.
+- API-token, runtime-database and migration-database credentials use disjoint,
+  namespace-limited OpenBao/ESO paths. Cross-namespace and sibling/parent-path
+  denials and runtime-versus-migration role separation passed.
+- A chart `0.3.1` lease refresh changed the runtime Secret and application
+  child PID while the pod UID stayed fixed, the container restart count stayed
+  zero, and readiness returned. Logs contained only the non-secret rotation
+  notice.
+
+## Private verification
+
+The hardened package verifier passed. Authenticated smoke run
+`20260820224419-43dc05` passed health, readiness, OpenAPI, four public catalogs,
+unauthenticated `401` enforcement, and authenticated protected reads and
+writes. The token was injected from approved custody, never copied into this
+repo, and the temporary token file was shredded after use.
+
+The next gate is `CORE-WP-0011-T04`. It requires separate explicit operator
+approval for a bounded write freeze, final transfer/reconciliation, public
+routing and tunnel changes, plus rollback readiness.