docs: complete railiance01 production cutover

workplans/CORE-WP-0011-railiance01-production-relocation.md

@@ -184,7 +184,7 @@ evidence is in
 
 ```task
 id: CORE-WP-0011-T04
-status: progress
+status: done
 priority: high
 ```
 
@@ -208,18 +208,31 @@ table counts and order-independent row-content digests match; Alembic
 `20260627_0002`, migration, the hardened verifier, direct target health/
 readiness, unauthenticated denial, and authenticated protected read pass.
 
-The cutover is paused only for the IONOS `hub.coulomb.social` A-record change
-from `92.205.130.254` to `92.205.62.239`. Target cert-manager is waiting on
-that HTTP-01 propagation. Do not restore source writes until the DNS/TLS/public
-smoke decision either completes or rolls back. Current evidence and exact
-rollback state are in
+Completed 2026-08-21 after the operator changed the authoritative IONOS A
+record from `92.205.130.254` to `92.205.62.239`. All four authoritative name
+servers and Google/Quad9 returned railiance01; Cloudflare retained the old
+address under its pre-change TTL, so CoulombCore remains read-only while that
+cache drains. A temporary, challenge-path-only bridge on CoulombCore and a
+solver-label/port-specific target NetworkPolicy allowed cert-manager to issue
+the production certificate without reopening either application or database
+access; both temporary resources were removed immediately afterward.
+
+The Let's Encrypt certificate verifies for `hub.coulomb.social`. Forced target
+checks passed health/readiness, all four public catalogs, protected-route and
+operator-console auth boundaries, authenticated reads, and the hardened live
+verifier. The first post-cutover write returned 201 and read back as event
+`e56bca14-51f8-4a73-bdab-f660e360fb14`. The ops-hub public gate and the
+deployed activity-core stabilization resolver both passed against railiance01.
+No active ops-bridge tunnel fronts the public hostname; it is a direct IONOS
+DNS route. The obsolete local `core-hub-staging-coulombcore` tunnel is deferred
+to T05. Current evidence and exact rollback state are in
 `docs/evidence/core-hub-railiance01-cutover-2026-08-21.md`.
 
 ## Stabilize and release CoulombCore dependencies
 
 ```task
 id: CORE-WP-0011-T05
-status: todo
+status: progress
 priority: high
 ```
 
@@ -229,11 +242,20 @@ critical path, retire `core-hub-staging` and any obsolete tunnel there, and
 record retained backup/rollback evidence and residual owners. Do not archive
 this repo unless the separate absorption workplan has also completed.
 
+Stabilization started 2026-08-21. Cloudflare, Google, Quad9 and the local
+resolver now all return `92.205.62.239`; normal public HTTPS reaches
+railiance01 with valid TLS. Helm revision 4 runs package chart `0.3.2`, which
+permanently carries the solver-label/kube-system/TCP-8089 NetworkPolicy needed
+for future certificate renewals, and the post-upgrade verifier passes. The
+CoulombCore Deployment remains Ready for rollback, but database-level
+`default_transaction_read_only=on` was reverified. Keep the source frozen until
+the bounded observation window and operator sign-off close this task.
+
 ## Acceptance
 
 - [x] Decommission deadline and live source/target inventory are recorded
 - [x] Governed rapp package renders and passes policy checks
 - [x] Shadow restore/reconciliation and consumer smokes pass on railiance01
-- [ ] Production traffic and tunnel move with explicit approval and rollback
+- [x] Production traffic and tunnel move with explicit approval and rollback
 - [ ] Stabilization passes and CoulombCore no longer hosts Core Hub dependencies
 - [ ] `CORE-WP-0010` remains independently sequenced behind `HUB-WP-0004`