informed-decision/docs/evidence/2026-10-11-purpose-image-release/execution

Version2 protected existing-snapshot rescue — prepared, unapproved

Original approved source bc6494cd completed drill-backup, then drill-copy failed before creating a local snapshot. Original journal drill-copy remains UNCERTAIN. Metadata-only capture proves exact unchanged main19537920bytes/SHA8756..., WAL0 and privateSHM32768. Source closes SQLite connections explicitly; immutable reads are only for the frozen main snapshot with exact prior digest/size/private identity and no WAL frames. Live source and offline pre/post-admin reads remain mode=ro/query_only WAL-aware; immutable is never a live DB or schema-migration shortcut. Sidecars remain retained, never deleted/checkpointed.

Fresh founder acceptance of the exact memo version2 is required before any rescue or continuation. Old version1 acceptance cannot pass authority checks. Root must freshly authenticate actual confirmed person/platform-root ACCEPT at the fixed native origin before each phase; protected receipt checking is supervised bookkeeping, not an authenticated signed/autonomous grant. No new native operation has run in this preparation.

Fixed order: drill-copy-rescue-r1 → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify; rollback → rollback-verify only after recorded new release attempt. New rescue-execution-journal-r1.json and rescue-execution-r1.lock coexist with the unchanged original execution-journal.json. They hash-link its exact original approved identity, COMPLETE backup and UNCERTAIN copy attempt IDs/results. No extra original phase or release is allowed; original journal hash is checked before and after each new phase. No old drill-copy retry/overwrite or synthesized completed phase.

Before rescue, original local drill.sqlite/cutover.sqlite must be absent, restore volume must be absent, and local engine bnt-lap001/current native oldimage7f5/source7db/sealedDeployment+CM/PVC/originalPodUID must match. The old backup admin already exited after uniquely creating the private fixed snapshot path; the only later original access was WAL-aware readonly inspection, with no snapshot writer. Main hash, private identities and absent/zero WAL are checked before/after immutable inspection and copy. Original private SHM is indexing and is retained unchanged. Nonempty WAL, changed hash/metadata, missing failed journal, missing origin or any unverified outcome stops rescue. No new native backup is made for the drill. Binary snapshot bytes flow only into a new0600 localfile, never chat/log/packet. Same rescue-phase retry is refused after any attempted outcome.

Offline verification explicitly consumes COMPLETE drill-copy-rescue-r1 result, not the old UNCERTAIN drill-copy. Existing exact isolated new-volume UID0/CAP_CHOWN initializer, followed by UID10001 readonly/admin/post-admin checks and retained original SHA, remains bounded networknone/readonlyroot/CPU1/128Mi with no host/nativePVC/runtimeconfig/token mounts. Only the disposable copy volume can be removed. Cutover snapshot is the distinct already-scoped new cutover.sqlite; rescue never overwrites drill.sqlite or creates another drill backup.

Four committed owner render Git blobs and helper/case hashes must match exact final source HEAD. ManualApplication rejects any automated configuration including {} or source overrides. Source-pin Application.operation uses server dry-run and UID/resourceVersion/source CAS, Deployment-only/prune=false; no whole-app sync. Rollback dispatch has no failing-candidate Pod/DB dependency; separate recovery proof checks oldimage Ready1/scopedoperation/schema5 retainedlatestDB. All phases including recovery/verification must begin by2026-10-12T23:59:59Z; after expiry obtain a fresh founder decision. No expiry controller or implicit extension.

Image763c/policy9d7c and known inherited fixable MEDIUM remain unchanged; owner T05 dueOct18. Ten installed checks use synthetic transport/native_provider=false and do not fulfill separate actual-provider T04 gate. Preserve original acceptance/backup/failure/history in this same trial. Twenty-six mocked/source executor regressions pass; no actual DB/admin/native command during tests/preparation.

Native publication route: POST existing source /lifecycle/memos/infd-20261011-purpose-overlay-r1/revisions with expected_version1 and exact memo2/documents/summary, then publications/review-requests version2. Fresh source readback must prove currentversion1 is unbound before revision; bound/different source stops. Intake/register refuse version2 as designed and are not used. Review integration creates a NEW review-ID at its own version1; founder disposition memo_version1 belongs to that new review. Root fresh outcomes must be queried for SOURCE version2, exact newreviewID/memoSHA and confirmed nested personapproval. Receipt outcome_query pins that sourceversion2 route; it does not authenticate by itself.