RPF-WP-0044-T08: old coulombcore ArgoCD is frozen (expired k3s certs); retirement moves to NK-WP-0022

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87

docs/evidence/2026-10-11-coulombcore-argocd-frozen.md

@@ -0,0 +1,20 @@
+# CoulombCore ArgoCD: frozen by expired k3s certificates — 2026-10-11
+
+Task: RPF-WP-0044-T08. Collected read-only from the host by claude-code (ssh `coulombcore`,
+`sudo -n`), without the Kubernetes API.
+
+- `/var/lib/rancher/k3s/server/tls/client-admin.crt` and `serving-kube-apiserver.crt`:
+  `notAfter=Aug 31 16:50:46 2026 GMT`. **Expired.** k3s has been active since 2026-05-24 15:24 UTC with
+  no restart, so no automatic rotation happened. This explains the "Unauthorized" seen on 2026-09-27
+  and 2026-10-11 for every client, root's own kubeconfig included.
+- Old ArgoCD (phase A install, undeclared) is still running as containers: application-controller,
+  applicationset-controller, repo-server, server, dex, redis. notifications-controller is on attempt 53.
+- With an expired API server certificate, the old controller cannot reconcile or prune. The legacy
+  `argocd/applications/` tree is therefore not at risk from it while the certificates stay expired.
+
+## Disposition (founder, 2026-10-11)
+
+CoulombCore is not needed for anything. It will be retired and the machine reused. **Do not rotate
+certificates or restart k3s on coulombcore.** That would revive the old controller with working
+credentials. Retirement proceeds under NK-WP-0022-T08: inventory from the host, then stop and wipe.
+RPF-WP-0044 treats the old controller as frozen and no longer waits on this check.