docs: record production cutover freeze

WORK-RECORDS.md

@@ -57,5 +57,5 @@
 | task | CORE-WP-0011-T01 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
 | task | CORE-WP-0011-T02 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
 | task | CORE-WP-0011-T03 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
-| task | CORE-WP-0011-T04 | todo | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
+| task | CORE-WP-0011-T04 | progress | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
 | task | CORE-WP-0011-T05 | todo | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |

docs/evidence/core-hub-railiance01-cutover-2026-08-21.md

@@ -0,0 +1,59 @@
+# Core Hub railiance01 production cutover — 2026-08-21
+
+Status: in progress; waiting for the operator-owned IONOS DNS edit.
+
+## Approved boundary
+
+The operator explicitly approved `CORE-WP-0011-T04`. This gate covers the
+bounded source write freeze, final transfer, public route change, verification
+and rollback readiness. CoulombCore resources remain intact through the later
+stabilization gate.
+
+## Freeze and final transfer
+
+- Public DNS still resolves `hub.coulomb.social` to CoulombCore
+  `92.205.130.254`; its observed TTL is 3600 seconds.
+- CoulombCore database `core_hub` now has
+  `default_transaction_read_only=on`. The source Deployment was restarted,
+  its application role reports `transaction_read_only=on`, and public health
+  and readiness remain HTTP 200.
+- Frozen full-archive SHA-256:
+  `4015ad622303ba206a46627ba0d03513e1054b95b87247d61cce6cb6b94189e6`.
+- The data-only transfer contained eight `COPY public.*` streams. Only the
+  statement schema qualifiers were mapped to `core_hub`; the source has no
+  sequence statements.
+- The target rehearsal state was backed up before its rows were cleared. Its
+  archive SHA-256 is
+  `92200f21d9f9ea01023ec74dd2e64641ec14544ee5a3a024f911c81e2ed67157`.
+- Restored target counts match the frozen source: `1, 3, 10, 2, 2, 3, 2, 16`
+  across `alembic_version`, `api_consumers`, `api_keys`,
+  `hub_capability_manifests`, `hubs`, `interaction_events`, `migration_runs`
+  and `widgets`.
+- Order-independent content digests match for all eight tables. Alembic is at
+  `20260627_0002`; the post-restore migration Job completed.
+
+## Target readiness
+
+- Helm revision 3 runs chart `0.3.1` at immutable image digest
+  `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`.
+- The railiance01 Deployment is Ready. The hardened package verifier passes.
+- Direct target resolution returns health/readiness 200, protected hubs 401
+  without authentication, and 200 with the governed token.
+- The Ingress is present at `92.205.62.239`. Certificate issuance is pending
+  because the IONOS A record still resolves the HTTP-01 challenge to the
+  source host.
+
+## Current rollback
+
+Before the DNS edit, rollback is:
+
+1. Roll railiance01 Helm release `core-hub` back from revision 3 to revision 2
+   to remove the target Ingress.
+2. On CoulombCore, reset database `core_hub`'s
+   `default_transaction_read_only` setting and restart Deployment
+   `core-hub-api` so the application reconnects writable.
+3. Verify public health, readiness and an authenticated protected operation.
+
+After DNS changes, restore `hub.coulomb.social` to `92.205.130.254` before
+reenabling source writes. Never allow both databases to accept production
+writes.

workplans/CORE-WP-0011-railiance01-production-relocation.md

@@ -184,7 +184,7 @@ evidence is in
 
 ```task
 id: CORE-WP-0011-T04
-status: todo
+status: progress
 priority: high
 ```
 
@@ -197,6 +197,24 @@ operator console, consumer smokes, and the first post-cutover write.
 Rollback must restore the prior traffic/tunnel target and database write path;
 the old runtime stays intact until stabilization closes.
 
+Cutover progress 2026-08-21: explicit operator approval entered this gate.
+Helm revision 3 enabled the chart `0.3.1` Ingress on railiance01 while public
+DNS still targeted CoulombCore. The source application was reconnected with
+database-default read-only mode and continues serving health/readiness, so
+stale-DNS readers remain available and writers fail closed. A fresh frozen
+archive was captured, the backed-up target rehearsal rows were replaced, and
+the source `public` tables were mapped into target schema `core_hub`. All eight
+table counts and order-independent row-content digests match; Alembic
+`20260627_0002`, migration, the hardened verifier, direct target health/
+readiness, unauthenticated denial, and authenticated protected read pass.
+
+The cutover is paused only for the IONOS `hub.coulomb.social` A-record change
+from `92.205.130.254` to `92.205.62.239`. Target cert-manager is waiting on
+that HTTP-01 propagation. Do not restore source writes until the DNS/TLS/public
+smoke decision either completes or rolls back. Current evidence and exact
+rollback state are in
+`docs/evidence/core-hub-railiance01-cutover-2026-08-21.md`.
+
 ## Stabilize and release CoulombCore dependencies
 
 ```task