Rehearse storage migration on recovered data and prepare the supervised release

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b

docs/release/storage-real-pair-rehearsal-2026-10-29.json

@@ -0,0 +1,34 @@
+{
+  "status": "recovered_data_candidate_verified",
+  "candidate_image_id": "sha256:512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd",
+  "migration": {
+    "status": "recovered_data_migration_lifecycle_verified",
+    "business_tables": 12,
+    "business_rows": 91,
+    "forward_preserves_all_business_rows": true,
+    "sql_collision_denied": true,
+    "rollback_preserves_all_business_rows_and_tenant_constraint": true,
+    "legacy_refusal_preserves_rows_and_grants": true,
+    "reapply_preserves_all_business_rows": true,
+    "global_constraint_present_after_reapply": true,
+    "production_access": false
+  },
+  "application": {
+    "status": "isolated_application_recovery_verified",
+    "recovered_spaces_with_content": 1,
+    "actual_pages_rendered_through_view": 39,
+    "restored_owner_access_verified": true,
+    "synthetic_viewer_reads": 1,
+    "synthetic_viewer_mutation_denials": 1,
+    "same_tenant_ungranted_page_denials": 39,
+    "fixture_transaction_rolled_back": true,
+    "production_access": false,
+    "external_identity_provider_used": false,
+    "real_browser_journey_verified": false
+  },
+  "content_files_unchanged": 82,
+  "network_internal": true,
+  "published_ports": 0,
+  "production_access": false,
+  "shared_view_check_sha256": "d1a641bb93e9ba9c5f879b806d81b1de37ba0743c542fc11137dd555a6b9f9ac"
+}

docs/release/storage-release-preflight-2026-10-29.json

@@ -0,0 +1,36 @@
+{
+  "status": "read_only_live_release_preflight_verified",
+  "cluster_uid_verified": true,
+  "helm_revision": 17,
+  "release_status": "deployed",
+  "replicas_ready": 1,
+  "deployment_strategy": "Recreate",
+  "pvc_bound": true,
+  "resource_count": 3,
+  "changes": [
+    {
+      "kind": "Deployment",
+      "field": "app image"
+    }
+  ],
+  "other_manifest_changes": false,
+  "candidate_render_sha256": "865b6a22b3c50c65a7417bb80de609b7e0290f54a99edebff497b2259bc067a2",
+  "baseline_helm_manifest_sha256": "da80414e13e7c5fd254803a241f21ade223b4b84e68ed908535e36e854b523a2",
+  "node_conditions": {
+    "EtcdIsVoter": "True",
+    "MemoryPressure": "False",
+    "DiskPressure": "False",
+    "PIDPressure": "False",
+    "Ready": "True"
+  },
+  "node_allocated_resources": "Allocated resources:\n  (Total limits may be over 100 percent, i.e., overcommitted.)\n  Resource           Requests       Limits\n  --------           --------       ------\n  cpu                2720m (68%)    40600m (1015%)\n  memory             12228Mi (76%)  41026Mi (256%)\n  ephemeral-storage  256Mi (0%)     1Gi (0%)\n  hugepages-1Gi      0 (0%)         0 (0%)\n  hugepages-2Mi      0 (0%)         0 (0%)\n",
+  "node_allocatable": {
+    "cpu": "4",
+    "ephemeral-storage": "196555267123",
+    "hugepages-1Gi": "0",
+    "hugepages-2Mi": "0",
+    "memory": "16377032Ki",
+    "pods": "110"
+  },
+  "live_changes_performed": false
+}

docs/release/storage-release-review-2026-10-29.md

@@ -0,0 +1,89 @@
+# Storage/content hardening release — exact supervised proposal
+
+Prepared, not deployed. Decision 05c9b00f-e4e4-4593-bdeb-c63fe6a4fe15 is pending
+founder disposition. Earlier backup/custody/schedule approvals remain in force.
+This packet does not reopen them or approve Bubble/apex cutover.
+
+Proposal digest:
+`sha256:3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132`.
+It binds 12 capsule members including all node/launcher/probe code, exact chart and
+values, dataset/schema expectations and the candidate snapshot-helper source.
+Any changed reviewed byte produces another digest and refuses execution.
+
+Deployment code is prepared on railiance-apps branch
+`csoc-storage-release-20261029`, commit45d6178. It has not been promoted to the
+deployment owner's main branch or applied to the cluster.
+
+## Exact result
+
+Target: `ADMINISTER @ realm:kubernetes/railiance01`, namespace/release
+coulomb-social, current Helm revision 17. Candidate product source 17d0eb6 at
+`sha256:512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd`.
+The candidate contains global slug constraint 0003, tested content revision/recovery
+hardening and strict original-date import guards. Renderer policy is unchanged.
+
+The attended command rechecks cluster/node, exact live spec/PVC/Helm baseline,
+headroom, no Argo adoption, data equality and server/client dry-runs. It then runs
+the already admitted fresh paired backup and immutable primary readback, checks
+the dataset again, and performs Helm --atomic/--wait with Recreate. The three
+resource manifests change only the app image; the PVC, configuration, resources
+and secret references are preserved. Startup applies the atomic SQL constraint;
+it does not rename/merge/delete business rows or change grants.
+
+Read-only postflight checks schema, all business/content aggregate hashes, actual
+owner pages and unsaved-outsider denials, plus public health/landing/static bytes.
+Only then refresh the root-owned snapshot helper's image pin to the new digest
+and repeat its server dry-run. No private key/recovery pair is delivered to the
+worker; no email, caller, issuer, DNS, apex, timer or production-data restore.
+
+## Evidence and limits
+
+- Packaged real recovered dataset: forward/refusal/reverse/reapply preserve all
+  12 business tables/91 rows and82 files; candidate renders 39 pages with owner/viewer/
+  ungranted checks. Old image also reads the migrated data and denies outsiders.
+- Live data hashes match the independently protected recovered point. Current
+  image 9a646d8e, one Ready replica, revision 17, Recreate, Bound PVC, no pressure.
+  Requests:68% CPU / 76% memory. Helm lint passes; exact sealed live preflight passes.
+- Product make check: 246 passed, including mandatory browser journeys. Ten
+  synthetic executor cases cover tampering, data drift, replay refusal, staging
+  immutability, unattended-launch refusal, rollback and capture cleanup timeout.
+
+The fresh capture normally pauses/resumes in about 54 seconds; previous app
+upgrades took about 20 seconds. Helm has a five-minute wait plus rollback handling.
+Failure preserves post-capture writes and the fresh point. Automatic rollback
+restores the prior image/revision, not database contents; the added uniqueness
+constraint may remain. Its separate SQL inverse and old-image read compatibility
+are rehearsed. A failed/uncertain attempt requires journal inspection, not replay.
+
+No new node/PVC/service capacity is committed. One existing-size encrypted
+generation/readback and normal API/storage usage are added. No EUR autopilot
+budget or risk grant is claimed; execution remains supervised.
+
+## Founder execution
+
+Run in your own terminal from the prepared deployment checkout:
+
+```sh
+python3 /tmp/csoc-storage-release-owner-20261029/tools/coulomb-storage-release.py \
+  --execute \
+  --expect-digest sha256:3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132 \
+  --output /tmp/csoc-storage-release-result-20261029.json
+```
+
+Review the digest and type DEPLOY followed by that full digest when prompted.
+The command uses the founder's existing SSH/sudo path and returns metadata only.
+No Scaleway login or credential pasted into chat is required. Reply done afterward;
+the agent must inspect the node receipt and postflight before recording acceptance.
+The durable node journal is
+`/var/lib/coulomb-social-backup/releases/<proposal-hex>/receipt.json`.
+
+This is an attended supervisor command, not a new credential/approval service.
+The active gated-executor profile is Kubernetes-only and cannot perform the
+root-owned node-helper refresh. Its configuration is left unchanged.
+
+The exact-action requirement comes from the-custodian's
+docs/agent-environment-orientation.md §4: “Every live change needs the founder's
+go-ahead”, and docs/agent-autonomy-decision.md: supervised privileged actions use
+an exact proposal; “The agent cannot approve itself.” This image/schema action
+has no current exact founder approval. Preparation and all observed checks above
+are complete; the app has not been changed by this packet.

docs/release/storage-rollback-compatibility-2026-10-29.json

@@ -0,0 +1,17 @@
+{
+  "business_tables": 12,
+  "business_rows": 91,
+  "business_rows_sha256": "1f404b7468011f8e006ed784628ade14bd03b53617282063f6d300df36f5090f",
+  "content_files": 82,
+  "content_files_sha256": "e3113909deccdab8135332c9e9fcacbed88f3216d9a1178f6b63da943aca3deb",
+  "global_slug_constraint": true,
+  "tenant_slug_constraint": true,
+  "migration_0003_applied": true,
+  "duplicate_slug_groups": 0,
+  "actual_owner_pages_rendered": 39,
+  "unsaved_outsider_page_denials": 39,
+  "production_identity_or_grant_created": false,
+  "status": "old_image_read_compatible_after_migration",
+  "production_access": false,
+  "image_id": "sha256:9a646d8e01a61ba5316d3c2eb0273064e17f2d0300ad07af766ccedda65ecb18"
+}

docs/release/storage-sealed-preflight-2026-10-29.json

@@ -0,0 +1,24 @@
+{
+  "schema": "coulomb.guarded-storage-release.v1",
+  "proposal_digest": "sha256:3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132",
+  "started_at": "2026-10-29T22:33:34.428700+00:00",
+  "status": "live_release_preflight_verified",
+  "production_data_restored": false,
+  "timers_activated": false,
+  "node_request_percent": {
+    "cpu": 68,
+    "memory": 76
+  },
+  "preflight": {
+    "business_tables": 12,
+    "business_rows": 91,
+    "business_rows_sha256": "1f404b7468011f8e006ed784628ade14bd03b53617282063f6d300df36f5090f",
+    "content_files": 82,
+    "content_files_sha256": "e3113909deccdab8135332c9e9fcacbed88f3216d9a1178f6b63da943aca3deb",
+    "global_slug_constraint": false,
+    "tenant_slug_constraint": true,
+    "migration_0003_applied": false,
+    "duplicate_slug_groups": 0
+  },
+  "live_changes": false
+}