Prepare supervised Coulomb storage migration release and guarded node execution

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b

docs/coulomb-storage-release-2026-10-29.md

@@ -0,0 +1,85 @@
+# Storage/content hardening release — exact supervised proposal
+
+Prepared, not deployed. Decision 05c9b00f-e4e4-4593-bdeb-c63fe6a4fe15 is pending
+founder disposition. Earlier backup/custody/schedule approvals remain in force.
+This packet does not reopen them or approve Bubble/apex cutover.
+
+Proposal digest:
+`sha256:3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132`.
+It binds 12 capsule members including all node/launcher/probe code, exact chart and
+values, dataset/schema expectations and the candidate snapshot-helper source.
+Any changed reviewed byte produces another digest and refuses execution.
+
+## Exact result
+
+Target: `ADMINISTER @ realm:kubernetes/railiance01`, namespace/release
+coulomb-social, current Helm revision 17. Candidate product source 17d0eb6 at
+`sha256:512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd`.
+The candidate contains global slug constraint 0003, tested content revision/recovery
+hardening and strict original-date import guards. Renderer policy is unchanged.
+
+The attended command rechecks cluster/node, exact live spec/PVC/Helm baseline,
+headroom, no Argo adoption, data equality and server/client dry-runs. It then runs
+the already admitted fresh paired backup and immutable primary readback, checks
+the dataset again, and performs Helm --atomic/--wait with Recreate. The three
+resource manifests change only the app image; the PVC, configuration, resources
+and secret references are preserved. Startup applies the atomic SQL constraint;
+it does not rename/merge/delete business rows or change grants.
+
+Read-only postflight checks schema, all business/content aggregate hashes, actual
+owner pages and unsaved-outsider denials, plus public health/landing/static bytes.
+Only then refresh the root-owned snapshot helper's image pin to the new digest
+and repeat its server dry-run. No private key/recovery pair is delivered to the
+worker; no email, caller, issuer, DNS, apex, timer or production-data restore.
+
+## Evidence and limits
+
+- Packaged real recovered dataset: forward/refusal/reverse/reapply preserve all
+  12 business tables/91 rows and82 files; candidate renders 39 pages with owner/viewer/
+  ungranted checks. Old image also reads the migrated data and denies outsiders.
+- Live data hashes match the independently protected recovered point. Current
+  image 9a646d8e, one Ready replica, revision 17, Recreate, Bound PVC, no pressure.
+  Requests:68% CPU / 76% memory. Helm lint passes; exact sealed live preflight passes.
+- Product make check: 246 passed, including mandatory browser journeys. Ten
+  synthetic executor cases cover tampering, data drift, replay refusal, staging
+  immutability, unattended-launch refusal, rollback and capture cleanup timeout.
+
+The fresh capture normally pauses/resumes in about 54 seconds; previous app
+upgrades took about 20 seconds. Helm has a five-minute wait plus rollback handling.
+Failure preserves post-capture writes and the fresh point. Automatic rollback
+restores the prior image/revision, not database contents; the added uniqueness
+constraint may remain. Its separate SQL inverse and old-image read compatibility
+are rehearsed. A failed/uncertain attempt requires journal inspection, not replay.
+
+No new node/PVC/service capacity is committed. One existing-size encrypted
+generation/readback and normal API/storage usage are added. No EUR autopilot
+budget or risk grant is claimed; execution remains supervised.
+
+## Founder execution
+
+Run in your own terminal from the prepared deployment checkout:
+
+```sh
+python3 /tmp/csoc-storage-release-owner-20261029/tools/coulomb-storage-release.py \
+  --execute \
+  --expect-digest sha256:3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132 \
+  --output /tmp/csoc-storage-release-result-20261029.json
+```
+
+Review the digest and type DEPLOY followed by that full digest when prompted.
+The command uses the founder's existing SSH/sudo path and returns metadata only.
+No Scaleway login or credential pasted into chat is required. Reply done afterward;
+the agent must inspect the node receipt and postflight before recording acceptance.
+The durable node journal is
+`/var/lib/coulomb-social-backup/releases/<proposal-hex>/receipt.json`.
+
+This is an attended supervisor command, not a new credential/approval service.
+The active gated-executor profile is Kubernetes-only and cannot perform the
+root-owned node-helper refresh. Its configuration is left unchanged.
+
+The exact-action requirement comes from the-custodian's
+docs/agent-environment-orientation.md §4: “Every live change needs the founder's
+go-ahead”, and docs/agent-autonomy-decision.md: supervised privileged actions use
+an exact proposal; “The agent cannot approve itself.” This image/schema action
+has no current exact founder approval. Preparation and all observed checks above
+are complete; the app has not been changed by this packet.