Complete CoulombCore identity backup gate

workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md

@@ -75,7 +75,7 @@ source backups remain a hard gate.
 
 ```task
 id: NK-WP-0022-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "fdc7b492-855f-471e-a7df-ee67a291d7a1"
 ```
@@ -90,6 +90,16 @@ logs, or chat.
 Done when restore evidence proves the migration can be reversed from
 independent custody.
 
+2026-07-28: created the age-encrypted source set documented in
+`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. Checksums,
+age decryption, both SQLite integrity checks, PostgreSQL dump readability,
+privacyIDEA archive readability, permissions, and plaintext cleanup passed.
+The encrypted set was then copied to mode-`0700` independent custody on
+railiance01 with mode-`0600` files and matching source hashes. A temporary,
+non-networked PostgreSQL 16 pod restored the full dump and reproduced the
+expected `interhub`, `privacyidea_db`, token, owner, realm, resolver, and policy
+counts. The pod and transient restore log were removed automatically.
+
 ## T03 - Reconcile persistent identity state onto railiance01
 
 ```task
@@ -109,6 +119,12 @@ Do not blindly overwrite newer railiance01-only configuration such as the
 Done when source/destination counts and semantic probes agree and restart
 tests pass on railiance01.
 
+Pre-migration comparison proves this task is required: LLDAP is 4/7/7
+users/groups/memberships on CoulombCore versus 3/7/3 on railiance01.
+CoulombCore privacyIDEA has one enrolled token, two realms, two resolvers, and
+two policies; railiance01 is empty. All privacyIDEA custody fingerprints
+differ, so its database and encryption/signing material must migrate together.
+
 ## T04 - Align configuration, secrets, and internal dependencies
 
 ```task