Close RAIL-HO-WP-0005-T02; record cutover Option A on WP-0005

Staged per-repo cutover is the official T11 mode. T02 design decisions complete.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -74,9 +74,9 @@ change is made there.
    daily age-encrypted `forgejo dump` + `pg_dump` → Nextcloud WebDAV; 14 daily +
    4 weekly retention; RPO 24h / RTO 4h. Record:
    `the-custodian/docs/forgejo-production-decisions.md` § Backup.
-6. Cutover mode: ~~freeze-all vs staged~~ **LEANING staged per-repo (2026-07-04)**
-   based on `glas-harness` pilot; operator confirmation still needed. Freeze-all
-   remains fallback for final production wave if drift risk is unacceptable.
+6. ~~Cutover mode~~ **DECIDED 2026-07-09 (Option A):** staged per-repo promotion
+   (no org-wide freeze). Freeze-all documented as emergency fallback only. Record:
+   `the-custodian/docs/forgejo-production-decisions.md` § Cutover.
 
 ## Safety Contract
 
@@ -176,34 +176,36 @@ pending before T11 wave for remaining production repos.
 
 ```task
 id: RAIL-HO-WP-0005-T02
-status: progress
+status: done
 priority: high
-needs_human: true
+needs_human: false
 state_hub_task_id: "f88115bf-4f99-49ef-a415-0b23750141b3"
 ```
 
 Decide the production choices listed in "Key Decisions to Confirm".
 
-**Partial (2026-07-09):** hostname, exposure, deployment pattern, live deploy,
-in-cluster runner model (`ADR-004`), **SMTP (IONOS, T06 done)**, **package scope
-(Option C)**, and **backup target (Option A: Nextcloud + age)** decided. Cutover
-mode **leaning** staged per-repo (glas-harness pilot). Remaining operator
-decision: final cutover confirmation. See
-`the-custodian/docs/forgejo-production-decisions.md`.
+**Done (2026-07-09):** All Key Decisions recorded in
+`the-custodian/docs/forgejo-production-decisions.md`:
+
+- Hostname, exposure, deployment pattern, live deploy (2026-07-03)
+- SMTP IONOS + OpenBao/ESO (T06 done 2026-07-08)
+- Package scope **Option C** (OCI + npm + generic; others as needed)
+- Actions runner in-cluster (`ADR-004`)
+- Backup **Option A** (Nextcloud + age; balanced retention)
+- Cutover **Option A** (staged per-repo; freeze-all emergency fallback only)
 
 Expected output:
 
-- A short decision record in this workplan or a dedicated ADR.
-- Hostname and exposure model. ✓ hostname; exposure follows railiance01 Traefik
+- A short decision record in this workplan or a dedicated ADR. ✓
+- Hostname and exposure model. ✓
 - SMTP provider and sender identity. ✓
-- Package registry scope. ✓ Option C (OCI + npm + generic; others as needed)
-- Actions runner isolation model.
-- Backup target, retention, encryption, and restore cadence. ✓ Option A
-  (Nextcloud; balanced retention; implementation T04/T09)
-- Cutover strategy and rollback window.
+- Package registry scope. ✓
+- Actions runner isolation model. ✓
+- Backup target, retention, encryption, and restore cadence. ✓
+- Cutover strategy and rollback window. ✓ staged per-repo + per-repo rollback
 
 **Done when:** implementation tasks are no longer blocked by open production
-choices.
+choices. **Met.**
 
 ---
 
@@ -518,17 +520,17 @@ Execute production migration only after T06, T07, T08, T09, and T10 tier 0–2
 gates pass. `state-hub` and other Wave-1 production repos require explicit
 operator approval per `CUST-WP-0054` drain sequence.
 
-**Preferred cutover (staged per-repo):**
+**Cutover mode (T02 Option A, 2026-07-09):** staged per-repo — no org-wide freeze.
 
-1. Per repo: Gitea backup snapshot (or org-wide before each wave).
+1. Per repo: Gitea backup snapshot before promotion.
 2. Mirror git to Forgejo; switch workstation `origin` to `forgejo-remote`.
 3. Port/verify Actions workflows on Forgejo runner.
 4. Update State Hub `remote_url` and railiance01 sweep checkouts when promoted.
-5. Mark Gitea repo read-only (org policy); do not delete.
-6. Repeat until production set complete.
+5. Mark **that** Gitea repo read-only; do not delete.
+6. Stabilization window; repeat until production set complete.
 
-**Freeze-all fallback:** single window if staged drift is unacceptable — same
-steps but all repos in one maintenance period.
+**Emergency fallback only:** org-wide freeze-all — not the primary plan; use if
+staged drift becomes unacceptable (document rollback before invoking).
 
 **Done when:** all Railiance/Custodian repos use Forgejo as primary, Gitea is
 read-only fallback, and rollback instructions are documented.
@@ -581,8 +583,9 @@ T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 
 **Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3
 `state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill
-**passed**; backup **target** decided (Option A). Scheduled automation still
-open (T04/T09). T02 cutover-mode confirmation remains operator-gated. T11 partial: `state-hub` primary
+**passed**; backup target decided (Option A); T02 **done** (all design decisions).
+Scheduled backup automation still open (T04/T09). Next: tier-3 staged promotions
+(T10/T11) after backup 7-day gate. T11 partial: `state-hub` primary
 on railiance01; ~57 State Hub repos still point at Gitea remotes.
 Do not retire coulombcore `state-hub` until phase 5 closeout and operator
 signoff (`CUST-WP-0054-T05`).