WP-0005: T12 prep checklist, backup gate 4/7, doc refresh

Update workplan with Jul 9 cron success (4/7 gate, ETA Jul 12), add Gitea
retirement dependency scan and operator checklist, and align deploy-stack,
restore-drill evidence, and migration inventory with post-cutover state.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -8,7 +8,7 @@ status: active
 owner: railiance
 topic_slug: railiance
 created: "2026-05-03"
-updated: "2026-07-08"
+updated: "2026-07-09"
 state_hub_workstream_id: "84e17675-0d15-4268-a8bd-540124d37018"
 ---
 
@@ -118,7 +118,7 @@ Still to prove before T11 closeout:
 
 - ~~SMTP/password reset end-to-end (T06).~~ **done** (2026-07-08).
 - ~~Backup restore from offsite artifact (T09).~~ **done** (2026-07-08); 7-day
-  scheduled backup gate **3/7** (cron PATH fixed 2026-07-08).
+  scheduled backup gate **4/7** (Jul 9 02:15 UTC cron succeeded; ETA **2026-07-12**).
 - ~~Repo migration ladder (T10).~~ **done** (2026-07-08); 0 Gitea-only repos.
 - ~~Operator SSH on Forgejo as `tegwick` (T05/T10).~~ **done**.
 - ~~Gitea read-only marking + operator signoff (T11).~~ **done** (2026-07-08).
@@ -257,8 +257,10 @@ decided (Option A, Nextcloud).** **Automation:** `railiance-platform`
 `pg_dump` → age → Nextcloud `forgejo/`. Daily cron 02:15 UTC; **cron PATH fixed
 2026-07-08** (`kubectl` was missing from cron env — Jul 8 02:15 run failed).
 **Nextcloud restore drill passed 2026-07-08.** Manual backup
-`20260708T131118Z` (~890M dump + 13M pg_dump) succeeded. Remaining: 7-day
-success gate (**3/7** as of 2026-07-08).
+`20260708T131118Z` (~890M dump + 13M pg_dump) succeeded. Jul 8 02:15 cron
+failed (`kubectl` missing from cron PATH); fixed same day. Jul 9 02:15 cron
+succeeded (`20260709T001505Z`, ~967M dump + 20M pg_dump). Remaining: 7-day
+success gate (**4/7** as of 2026-07-09; ETA **2026-07-12**).
 
 **Done when:** platform dependencies can be deployed and restored without the
 Forgejo app running.
@@ -457,9 +459,9 @@ Makefile targets. **First scheduled backup:** 20260707T180844Z (~686M, 14 repos)
 Daily cron 02:15 UTC. **Nextcloud restore drill passed 2026-07-08** — decrypt
 uploaded `.age` artifact, chunked copy, 14 org repos restored in
 `forgejo-restore-drill` (evidence: `docs/forgejo-restore-drill-evidence.md`).
-Remaining: 7 consecutive backup successes (**3/7** as of 2026-07-08); cron PATH
-fixed so nightly runs resume. Nextcloud file-drop is upload-only — read-lane TBD
-for DR without workstation cache.
+Remaining: 7 consecutive backup successes (**4/7** as of 2026-07-09; ETA
+**2026-07-12**). Jul 9 02:15 UTC cron run succeeded after PATH fix. Nextcloud
+file-drop is upload-only — read-lane TBD for DR without workstation cache.
 
 **Done when:** a fresh backup restores to a working isolated Forgejo instance
 with repository, package, and user recovery checks passing **and** scheduled
@@ -583,6 +585,12 @@ state_hub_task_id: "a63147b0-31d5-4705-89ea-40c10faf779f"
 
 Retire legacy Gitea only after a stabilization period and explicit approval.
 
+**Prep (2026-07-09):** dependency scan complete — State Hub **0 Gitea remotes**,
+workstation **0 `gitea-remote` origins**; coulombcore `gitea` Helm still running
+as read-only fallback. Checklist: `docs/forgejo-gitea-retirement-checklist.md`.
+Operator must choose: **Option A** keep fallback (recommended until 90-day
+rollback window) or **Option B** retire Helm release.
+
 Minimum scope:
 
 - Confirm no active remotes, webhooks, packages, or dashboards depend on Gitea.
@@ -615,9 +623,10 @@ T05+T08 ──► T10 migration ladder ──► T11 production cutover ──
 T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 ```
 
-**Current focus (2026-07-08):** T01/T05/T06/T07/T08/T10/T11 **done**; T04/T09
-await 7-day backup gate (**3/7**; cron PATH fixed). T12 next after
-stabilization window — Gitea archived + package push disabled; ArgoCD on Forgejo.
+**Current focus (2026-07-09):** T01/T05/T06/T07/T08/T10/T11 **done**; T04/T09
+await 7-day backup gate (**4/7**, ETA **2026-07-12**). T12 prep complete —
+operator decision pending (retire vs keep fallback). `state-hub` stabilization
+window closed 2026-07-09.
 
 **Absorbed by `CUST-WP-0054-T04`:** forge + CI on railiance01; workstation
 build retirement; staged repo promotion before State Hub primary move (T05).
@@ -646,6 +655,7 @@ purpose is identified.
 - `docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md`
 - `docs/forgejo-migration-inventory.md`
 - `docs/forgejo-cutover-rollback.md`
+- `docs/forgejo-gitea-retirement-checklist.md`
 - `the-custodian/docs/forgejo-production-decisions.md`
 - `the-custodian/docs/forgejo-repo-migration-pilot-glas-harness.md`
 - `railiance-apps/docs/forgejo-on-railiance01.md`