Complete RAIL-HO-WP-0005 T11 production cutover

Gitea org archived (79/79), package push disabled, ArgoCD repointed to Forgejo,
and rollback runbook added. Mark T11 done; T12 remains after stabilization.

docs/forgejo-cutover-rollback.md

@@ -0,0 +1,93 @@
+# Forgejo Cutover Rollback Runbook
+
+Date: 2026-07-08  
+Workplan: `RAIL-HO-WP-0005-T11`  
+Canon: `the-custodian/docs/forgejo-tier3-remote-url-sweep-playbook.md`
+
+## Current production state (post-T11)
+
+| Layer | Canonical | Fallback |
+| --- | --- | --- |
+| Git forge | `forgejo.coulomb.social` (`forgejo-remote`) | `gitea.coulomb.social` (archived, read-only) |
+| State Hub `remote_url` | `forgejo-remote:coulomb/<slug>.git` | — |
+| Workstation `origin` | `forgejo-remote:coulomb/<slug>.git` | `gitea` legacy remote retained |
+| ArgoCD (coulombcore) | `https://forgejo.coulomb.social/coulomb/*.git` | Gitea URLs in AppProject allow-list for emergency |
+
+Gitea safety contract: **no repo deletes** for ≥90 days after promotion. Archived
+repos remain cloneable; pushes are rejected.
+
+## Per-repo git rollback
+
+When a single repo must revert to Gitea as canonical:
+
+```bash
+cd ~/<slug>
+git remote rename origin forgejo
+git remote rename gitea origin
+git fetch origin
+git status   # confirm tracking branch
+```
+
+Optional: re-mirror last known-good Forgejo SHA to Gitea (requires temporarily
+un-archiving the repo via Gitea admin API — operator only).
+
+## State Hub rollback
+
+```bash
+SLUG=<repo-slug>
+API=http://127.0.0.1:8000
+curl -s -X PATCH "${API}/repos/${SLUG}" \
+  -H "Content-Type: application/json" \
+  -d '{"remote_url": "gitea-remote:coulomb/'"${SLUG}"'.git"}' | python3 -m json.tool
+statehub fix-consistency --repo "${SLUG}"
+```
+
+## ArgoCD rollback (coulombcore)
+
+Re-point the affected `Application` `spec.source.repoURL` to Gitea, or re-apply
+a known-good manifest:
+
+```bash
+cd ~/railiance-platform
+KUBECONFIG=~/.kube/config kubectl apply -f argocd/applications/<app>.application.yaml
+```
+
+AppProjects `railiance-tenants` and `railiance-platform-addons` retain Gitea
+URLs in `sourceRepos` for emergency rollback.
+
+## Gitea read-only reversal (operator)
+
+To allow pushes again on a Gitea repo (rollback window only):
+
+```bash
+# Un-archive one repo
+source ~/.railiance_gitea.conf
+curl -sS -X PATCH -H "Authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{"archived":false}' \
+  "https://gitea.coulomb.social/api/v1/repos/coulomb/<slug>"
+```
+
+Org-wide un-archive: `the-custodian/tools/gitea-set-readonly.sh` inverted
+patch — use only with explicit operator approval.
+
+## Verification after rollback
+
+- [ ] `git push origin main` succeeds on Gitea
+- [ ] State Hub `remote_url` matches `gitea-remote:coulomb/<slug>.git`
+- [ ] `statehub fix-consistency --repo <slug>` → PASS
+- [ ] Dependent CI/deploy paths re-tested
+
+## Emergency org-wide freeze (not primary plan)
+
+If staged drift is unacceptable, invoke org-wide freeze per
+`the-custodian/docs/forgejo-production-decisions.md` § Cutover Option A
+fallback. Document the decision via State Hub `POST /decisions/` before
+executing.
+
+## References
+
+- `docs/forgejo-migration-inventory.md`
+- `the-custodian/tools/gitea-set-readonly.sh`
+- `the-custodian/tools/patch-forgejo-remote-urls.sh`
+- `railiance-enablement/tools/promote-repo-to-forgejo.sh`