From 8e67cfbb495ac0f09244c559e6f24ff99277906c Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 19 Oct 2026 14:52:41 +0200
Subject: [PATCH] Refresh live allocation baseline for synthetic sizing review

---
 ...10-19-allocation-reconcile-provenance.json |  31 +
 .../2026-10-19-allocation-reconcile.json      | 761 ++++++++++++++++++
 .../2026-10-19-allocation-reconcile.md        |  97 +++
 ...sured-workload-sizing-and-weekly-review.md |  17 +
 4 files changed, 906 insertions(+)
 create mode 100644 docs/evidence/2026-10-19-allocation-reconcile-provenance.json
 create mode 100644 docs/evidence/2026-10-19-allocation-reconcile.json
 create mode 100644 docs/evidence/2026-10-19-allocation-reconcile.md

diff --git a/docs/evidence/2026-10-19-allocation-reconcile-provenance.json b/docs/evidence/2026-10-19-allocation-reconcile-provenance.json
new file mode 100644
index 0000000..6116683
--- /dev/null
+++ b/docs/evidence/2026-10-19-allocation-reconcile-provenance.json
@@ -0,0 +1,31 @@
+{
+  "schema": "custodian.allocation-capture-provenance.v1",
+  "captured_at": "2026-10-19T12:50:41Z",
+  "target_node_ip_verified": "92.205.62.239",
+  "read_only": true,
+  "raw_kubectl_errors_emitted": false,
+  "inputs": [
+    {
+      "path": "scripts/reconcile_railiance_allocation.py",
+      "sha256": "6ac53501332d3a649dae59eea8f801de12eee20b1dad5978eedc6ab2f953119a"
+    },
+    {
+      "path": "docs/evidence/namespace-ownership.yaml",
+      "sha256": "bc82fbd6c3469312c3ebc72fdc23a7035a1db2d7b0df58c38f4d6eff6ae1e7cc"
+    },
+    {
+      "path": "/home/worsch/railiance-cluster/tools/observe_cluster_resources.py",
+      "sha256": "7a613f7ba692169ec9ddf498f7250ee2a56f8fb1088585498af6df2302e15002"
+    },
+    {
+      "path": "/home/worsch/state-hub/scripts/release_headroom_preflight.py",
+      "sha256": "75d46a6e0f6dec4f3e94aac616eb9363c78745d0658a75beea7138253da6a414"
+    }
+  ],
+  "limitations": [
+    "Single capture; not a representative demand window",
+    "Grouped workload names use owner collector labels; ownership mapping retains unknown namespaces",
+    "Historical signal notes do not assert current telemetry configuration",
+    "395m residual is reservation arithmetic, not workload or release admission"
+  ]
+}
diff --git a/docs/evidence/2026-10-19-allocation-reconcile.json b/docs/evidence/2026-10-19-allocation-reconcile.json
new file mode 100644
index 0000000..a3d51e2
--- /dev/null
+++ b/docs/evidence/2026-10-19-allocation-reconcile.json
@@ -0,0 +1,761 @@
+{
+  "schema": "custodian.allocation-reconcile.v1",
+  "workplan_id": "CUST-WP-0071-T01",
+  "captured_at": "2026-10-19T12:50:41Z",
+  "cluster_observation_schema": "railiance.cluster-resource-observation.v1",
+  "count_host_and_cluster_cpus_once": true,
+  "host": {
+    "owner": "railiance-cluster",
+    "resource_id": "resource:hosteurope:railiance01",
+    "same_cpus_as_cluster": true,
+    "cluster_resource_id": "resource:railiance:reef-railiance:k3s"
+  },
+  "capacity_cpu_m": 4000,
+  "scheduled_request_cpu_m": 3605,
+  "pending_unscheduled_cpu_m": 0,
+  "residual_cpu_m": 395,
+  "not_a_scheduling_guarantee": true,
+  "workloads": [
+    {
+      "namespace": "state-hub",
+      "workload": "railiance-apps",
+      "pods": 2,
+      "cpu_request_m": 260,
+      "memory_request_bytes": 671088640,
+      "owner": "state-hub",
+      "service": "state-hub",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "core-hub",
+      "workload": "rapp-core-hub",
+      "pods": 3,
+      "cpu_request_m": 200,
+      "memory_request_bytes": 939524096,
+      "owner": "core-hub",
+      "service": "core-hub",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "databases",
+      "workload": "forgejo-db",
+      "pods": 1,
+      "cpu_request_m": 200,
+      "memory_request_bytes": 536870912,
+      "owner": "rapp-postgres",
+      "service": "apps-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "sso",
+      "workload": "net-kingdom-sso-mfa",
+      "pods": 4,
+      "cpu_request_m": 150,
+      "memory_request_bytes": 268435456,
+      "owner": "net-kingdom",
+      "service": "keycape-authelia",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "flex-auth",
+      "workload": "flex-auth",
+      "pods": 9,
+      "cpu_request_m": 145,
+      "memory_request_bytes": 301989888,
+      "owner": "flex-auth",
+      "service": "flex-auth",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "knative-serving",
+      "workload": "knative-serving",
+      "pods": 4,
+      "cpu_request_m": 140,
+      "memory_request_bytes": 377487360,
+      "owner": "rail-knative",
+      "service": "knative-serving",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "mfa",
+      "workload": "net-kingdom-sso-mfa",
+      "pods": 1,
+      "cpu_request_m": 110,
+      "memory_request_bytes": 402653184,
+      "owner": "net-kingdom",
+      "service": "lldap-mfa",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "reuse",
+      "workload": "reuse-surface",
+      "pods": 2,
+      "cpu_request_m": 110,
+      "memory_request_bytes": 301989888,
+      "owner": "reuse-surface",
+      "service": "reuse-surface",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "activity-core",
+      "workload": "activity-core",
+      "pods": 10,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "activity-core",
+      "service": "activity-core",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "cnpg-system",
+      "workload": "cloudnative-pg",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 104857600,
+      "owner": "rapp-postgres",
+      "service": "cloudnative-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "coulomb-social",
+      "workload": "coulomb-social",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "coulomb-social",
+      "service": "coulomb-social",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "databases",
+      "workload": "apps-pg",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "rapp-postgres",
+      "service": "apps-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "databases",
+      "workload": "net-kingdom-pg",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "rapp-postgres",
+      "service": "apps-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "databases",
+      "workload": "platform-pg",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "rapp-postgres",
+      "service": "apps-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "databases",
+      "workload": "platform-pg-2",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "rapp-postgres",
+      "service": "apps-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "forgejo",
+      "workload": "gitea",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 134217728,
+      "owner": "railiance-forge",
+      "service": "forgejo",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kube-system",
+      "workload": "coredns-7bdb54f89",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 73400320,
+      "owner": "railiance-cluster",
+      "service": "k3s-control-plane",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kube-system",
+      "workload": "metrics-server-786d997795",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 73400320,
+      "owner": "railiance-cluster",
+      "service": "k3s-control-plane",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "openbao",
+      "workload": "openbao",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "railiance-platform",
+      "service": "openbao",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "playwright",
+      "workload": "rapp-playwright",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "unknown",
+      "service": "unknown",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "telemetry",
+      "workload": "prometheus",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 536870912,
+      "owner": "rapp-telemetry",
+      "service": "prometheus-grafana",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "user-engine",
+      "workload": "user-engine-pg",
+      "pods": 1,
+      "cpu_request_m": 100,
+      "memory_request_bytes": 268435456,
+      "owner": "user-engine",
+      "service": "user-engine",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "telemetry",
+      "workload": "grafana",
+      "pods": 1,
+      "cpu_request_m": 70,
+      "memory_request_bytes": 201326592,
+      "owner": "rapp-telemetry",
+      "service": "prometheus-grafana",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "vergabe-demo-company",
+      "workload": "vergabe-teilnahme",
+      "pods": 1,
+      "cpu_request_m": 60,
+      "memory_request_bytes": 268435456,
+      "owner": "railiance-apps",
+      "service": "vergabe-teilnahme",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "argocd",
+      "workload": "argocd-application-controller",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 268435456,
+      "owner": "railiance-enablement",
+      "service": "argocd",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "audit-core",
+      "workload": "audit-core",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 67108864,
+      "owner": "audit-core",
+      "service": "audit-core",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "coulomb",
+      "workload": "ihp-railiance-probe",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 134217728,
+      "owner": "unknown",
+      "service": "ihp-railiance-probe",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "issue-core",
+      "workload": "issue-core",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 134217728,
+      "owner": "issue-core",
+      "service": "issue-core",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kourier-system",
+      "workload": "3scale-kourier-gateway",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 209715200,
+      "owner": "rail-knative",
+      "service": "kourier",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "target-revenue",
+      "workload": "target-revenue",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 268435456,
+      "owner": "target-revenue",
+      "service": "target-revenue",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "user-engine",
+      "workload": "user-engine",
+      "pods": 1,
+      "cpu_request_m": 50,
+      "memory_request_bytes": 67108864,
+      "owner": "user-engine",
+      "service": "user-engine",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "knative-serving",
+      "workload": "net-kourier-controller",
+      "pods": 1,
+      "cpu_request_m": 30,
+      "memory_request_bytes": 209715200,
+      "owner": "rail-knative",
+      "service": "knative-serving",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "argocd",
+      "workload": "argocd-repo-server",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 134217728,
+      "owner": "railiance-enablement",
+      "service": "argocd",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "canned-prompts",
+      "workload": "canned-prompts",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 100663296,
+      "owner": "canned-prompts",
+      "service": "canned-prompts",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "email-connect",
+      "workload": "email-connect",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 67108864,
+      "owner": "email-connect",
+      "service": "email-connect",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "openbao",
+      "workload": "railiance-platform",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 33554432,
+      "owner": "railiance-platform",
+      "service": "openbao",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "rein-aharness",
+      "workload": "rein-aharness",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 67108864,
+      "owner": "rein-aharness",
+      "service": "rein-aharness",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "sbom-nexus",
+      "workload": "sbom-nexus",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 67108864,
+      "owner": "sbom-nexus",
+      "service": "sbom-nexus",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "telemetry",
+      "workload": "alertmanager",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 67108864,
+      "owner": "rapp-telemetry",
+      "service": "prometheus-grafana",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "telemetry",
+      "workload": "kube-state-metrics",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 67108864,
+      "owner": "rapp-telemetry",
+      "service": "prometheus-grafana",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "telemetry",
+      "workload": "rapp-telemetry",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 134217728,
+      "owner": "rapp-telemetry",
+      "service": "prometheus-grafana",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "tenant-engine",
+      "workload": "tenant-engine",
+      "pods": 1,
+      "cpu_request_m": 25,
+      "memory_request_bytes": 50331648,
+      "owner": "tenant-engine",
+      "service": "tenant-engine",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "mas",
+      "workload": "mas-mx",
+      "pods": 1,
+      "cpu_request_m": 20,
+      "memory_request_bytes": 67108864,
+      "owner": "unknown",
+      "service": "unknown",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "rapp-qonto",
+      "workload": "rapp-qonto-audit-collector",
+      "pods": 1,
+      "cpu_request_m": 20,
+      "memory_request_bytes": 33554432,
+      "owner": "unknown",
+      "service": "unknown",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "rapp-qonto-egress",
+      "workload": "qonto-egress-proxy",
+      "pods": 1,
+      "cpu_request_m": 20,
+      "memory_request_bytes": 67108864,
+      "owner": "rapp-qonto",
+      "service": "qonto-egress",
+      "tenant": "tenant:friendly:binky"
+    },
+    {
+      "namespace": "activity-core",
+      "workload": "actcore-temporal-ui-tls-2-1888679036-1756117428",
+      "pods": 1,
+      "cpu_request_m": 10,
+      "memory_request_bytes": 67108864,
+      "owner": "activity-core",
+      "service": "activity-core",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "approval-engine",
+      "workload": "approval-engine",
+      "pods": 1,
+      "cpu_request_m": 10,
+      "memory_request_bytes": 67108864,
+      "owner": "approval-engine",
+      "service": "approval-engine",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "argocd",
+      "workload": "argocd-applicationset-controller",
+      "pods": 1,
+      "cpu_request_m": 10,
+      "memory_request_bytes": 67108864,
+      "owner": "railiance-enablement",
+      "service": "argocd",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "argocd",
+      "workload": "argocd-redis",
+      "pods": 1,
+      "cpu_request_m": 10,
+      "memory_request_bytes": 33554432,
+      "owner": "railiance-enablement",
+      "service": "argocd",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "policy-nexus",
+      "workload": "policy-nexus",
+      "pods": 1,
+      "cpu_request_m": 10,
+      "memory_request_bytes": 33554432,
+      "owner": "policy-nexus",
+      "service": "policy-nexus",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "bao-notice",
+      "workload": "bao-notice",
+      "pods": 1,
+      "cpu_request_m": 5,
+      "memory_request_bytes": 16777216,
+      "owner": "railiance-platform",
+      "service": "bao-notice",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "informed-decision",
+      "workload": "informed-decision",
+      "pods": 1,
+      "cpu_request_m": 5,
+      "memory_request_bytes": 67108864,
+      "owner": "informed-decision",
+      "service": "informed-decision",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "mas",
+      "workload": "mas-statute",
+      "pods": 1,
+      "cpu_request_m": 5,
+      "memory_request_bytes": 33554432,
+      "owner": "unknown",
+      "service": "unknown",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "state-hub",
+      "workload": "state-hub",
+      "pods": 1,
+      "cpu_request_m": 5,
+      "memory_request_bytes": 25165824,
+      "owner": "state-hub",
+      "service": "state-hub",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "cert-manager",
+      "workload": "cainjector",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "cert-manager",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "cert-manager",
+      "workload": "cert-manager",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "cert-manager",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "cert-manager",
+      "workload": "webhook",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "cert-manager",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "databases",
+      "workload": "state-hub-db",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "rapp-postgres",
+      "service": "apps-pg",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "external-secrets",
+      "workload": "external-secrets",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-platform",
+      "service": "external-secrets",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "external-secrets",
+      "workload": "external-secrets-cert-controller",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-platform",
+      "service": "external-secrets",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "external-secrets",
+      "workload": "external-secrets-webhook",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-platform",
+      "service": "external-secrets",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "forgejo",
+      "workload": "forgejo-runner",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-forge",
+      "service": "forgejo",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kube-system",
+      "workload": "local-path-provisioner",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "k3s-control-plane",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kube-system",
+      "workload": "svclb-mas-smtp-d86db2b1",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "k3s-control-plane",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kube-system",
+      "workload": "svclb-traefik-0c8aecaf",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "k3s-control-plane",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "kube-system",
+      "workload": "traefik",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "railiance-cluster",
+      "service": "k3s-control-plane",
+      "tenant": "unknown"
+    },
+    {
+      "namespace": "target-revenue",
+      "workload": "target-revenue-pg",
+      "pods": 1,
+      "cpu_request_m": 0,
+      "memory_request_bytes": 0,
+      "owner": "target-revenue",
+      "service": "target-revenue",
+      "tenant": "unknown"
+    }
+  ],
+  "unknown_namespaces": [
+    "mas",
+    "playwright",
+    "rapp-qonto"
+  ],
+  "zero_request_workloads": [
+    "cert-manager/cainjector",
+    "cert-manager/cert-manager",
+    "cert-manager/webhook",
+    "databases/state-hub-db",
+    "external-secrets/external-secrets",
+    "external-secrets/external-secrets-cert-controller",
+    "external-secrets/external-secrets-webhook",
+    "forgejo/forgejo-runner",
+    "kube-system/local-path-provisioner",
+    "kube-system/svclb-mas-smtp-d86db2b1",
+    "kube-system/svclb-traefik-0c8aecaf",
+    "kube-system/traefik",
+    "target-revenue/target-revenue-pg"
+  ],
+  "pending_unscheduled": [],
+  "measurement_gaps": [
+    "node 239.62.205.92.host.secureserver.net lacks independent region/zone labels"
+  ],
+  "state_hub_preflight_observation": {
+    "schema": "state-hub.release-headroom-preflight.v1-input",
+    "observed_at": "2026-10-19T12:50:41Z",
+    "freshness_seconds": 0,
+    "nodes": [
+      {
+        "name": "239.62.205.92.host.secureserver.net",
+        "ready": true,
+        "unschedulable": false,
+        "allocatable_cpu_m": 4000,
+        "allocatable_memory_bytes": 16770080768,
+        "allocated_cpu_m": 3605,
+        "allocated_memory_bytes": 10334765056
+      }
+    ],
+    "pending_unrelated": []
+  },
+  "signal_notes": [
+    "Host resource:hosteurope:railiance01 and cluster resource:railiance:reef-railiance:k3s are the same 4 vCPU; do not add them.",
+    "Prometheus namespace_cpu:kube_pod_container_resource_requests:sum omitted Forgejo 100m on 2026-09-11; Kubernetes API is the scheduler-effective source.",
+    "node-exporter was disabled; host CPU usage is not a reservation and is not treated as spare capacity.",
+    "Zero-request pods are demand, not zero. Missing metrics are listed as gaps, not zeros.",
+    "STATE-WP-0091 preflight consumes state_hub_preflight_observation; residual millicores are not admission."
+  ],
+  "state_hub_preflight": {
+    "schema": "state-hub.release-headroom-preflight.v1",
+    "ok": true,
+    "observed_at": "2026-10-19T12:50:41Z",
+    "freshness_seconds": 0,
+    "remaining_cpu_m": 395,
+    "remaining_memory_bytes": 6435315712,
+    "pending_unrelated_cpu_m": 0,
+    "api_surge_cpu_m": 100,
+    "mcp_surge_cpu_m": 10,
+    "migrate_cpu_m": 50,
+    "atomic": true,
+    "reasons": [],
+    "notes": [
+      "Aggregate remaining millicores is not a kube-scheduler guarantee.",
+      "Preflight does not lower requests and does not start Helm."
+    ],
+    "hook_order": [
+      "pre-upgrade migrate job (helm.sh/hook-weight -5)",
+      "API RollingUpdate maxSurge=1 maxUnavailable=0",
+      "MCP RollingUpdate maxSurge=1 maxUnavailable=0"
+    ]
+  }
+}
diff --git a/docs/evidence/2026-10-19-allocation-reconcile.md b/docs/evidence/2026-10-19-allocation-reconcile.md
new file mode 100644
index 0000000..c918fac
--- /dev/null
+++ b/docs/evidence/2026-10-19-allocation-reconcile.md
@@ -0,0 +1,97 @@
+# Railiance allocation reconcile — 2026-10-19T12:50:41Z
+
+CUST-WP-0071-T01. Scheduler-effective requests from the Kubernetes API
+via `railiance-cluster` observe (RCLUSTER-WP-0014 / RAIL-BS-WP-0014).
+Host and cluster are the same 4 vCPU and are counted once.
+
+- Capacity: 4000m
+- Scheduled requests: 3605m
+- Pending unscheduled: 0m
+- Residual (not a guarantee): 395m
+- Unknown namespaces: mas, playwright, rapp-qonto
+- Zero-request workloads: 13
+
+| Namespace | Workload | Owner | Tenant | CPU request (m) | Pods |
+|---|---|---|---|---:|---:|
+| state-hub | railiance-apps | state-hub | unknown | 260 | 2 |
+| core-hub | rapp-core-hub | core-hub | unknown | 200 | 3 |
+| databases | forgejo-db | rapp-postgres | unknown | 200 | 1 |
+| sso | net-kingdom-sso-mfa | net-kingdom | unknown | 150 | 4 |
+| flex-auth | flex-auth | flex-auth | unknown | 145 | 9 |
+| knative-serving | knative-serving | rail-knative | unknown | 140 | 4 |
+| mfa | net-kingdom-sso-mfa | net-kingdom | unknown | 110 | 1 |
+| reuse | reuse-surface | reuse-surface | unknown | 110 | 2 |
+| activity-core | activity-core | activity-core | unknown | 100 | 10 |
+| cnpg-system | cloudnative-pg | rapp-postgres | unknown | 100 | 1 |
+| coulomb-social | coulomb-social | coulomb-social | unknown | 100 | 1 |
+| databases | apps-pg | rapp-postgres | unknown | 100 | 1 |
+| databases | net-kingdom-pg | rapp-postgres | unknown | 100 | 1 |
+| databases | platform-pg | rapp-postgres | unknown | 100 | 1 |
+| databases | platform-pg-2 | rapp-postgres | unknown | 100 | 1 |
+| forgejo | gitea | railiance-forge | unknown | 100 | 1 |
+| kube-system | coredns-7bdb54f89 | railiance-cluster | unknown | 100 | 1 |
+| kube-system | metrics-server-786d997795 | railiance-cluster | unknown | 100 | 1 |
+| openbao | openbao | railiance-platform | unknown | 100 | 1 |
+| playwright | rapp-playwright | unknown | unknown | 100 | 1 |
+| telemetry | prometheus | rapp-telemetry | unknown | 100 | 1 |
+| user-engine | user-engine-pg | user-engine | unknown | 100 | 1 |
+| telemetry | grafana | rapp-telemetry | unknown | 70 | 1 |
+| vergabe-demo-company | vergabe-teilnahme | railiance-apps | unknown | 60 | 1 |
+| argocd | argocd-application-controller | railiance-enablement | unknown | 50 | 1 |
+| audit-core | audit-core | audit-core | unknown | 50 | 1 |
+| coulomb | ihp-railiance-probe | unknown | unknown | 50 | 1 |
+| issue-core | issue-core | issue-core | unknown | 50 | 1 |
+| kourier-system | 3scale-kourier-gateway | rail-knative | unknown | 50 | 1 |
+| target-revenue | target-revenue | target-revenue | unknown | 50 | 1 |
+| user-engine | user-engine | user-engine | unknown | 50 | 1 |
+| knative-serving | net-kourier-controller | rail-knative | unknown | 30 | 1 |
+| argocd | argocd-repo-server | railiance-enablement | unknown | 25 | 1 |
+| canned-prompts | canned-prompts | canned-prompts | unknown | 25 | 1 |
+| email-connect | email-connect | email-connect | unknown | 25 | 1 |
+| openbao | railiance-platform | railiance-platform | unknown | 25 | 1 |
+| rein-aharness | rein-aharness | rein-aharness | unknown | 25 | 1 |
+| sbom-nexus | sbom-nexus | sbom-nexus | unknown | 25 | 1 |
+| telemetry | alertmanager | rapp-telemetry | unknown | 25 | 1 |
+| telemetry | kube-state-metrics | rapp-telemetry | unknown | 25 | 1 |
+| telemetry | rapp-telemetry | rapp-telemetry | unknown | 25 | 1 |
+| tenant-engine | tenant-engine | tenant-engine | unknown | 25 | 1 |
+| mas | mas-mx | unknown | unknown | 20 | 1 |
+| rapp-qonto | rapp-qonto-audit-collector | unknown | unknown | 20 | 1 |
+| rapp-qonto-egress | qonto-egress-proxy | rapp-qonto | tenant:friendly:binky | 20 | 1 |
+| activity-core | actcore-temporal-ui-tls-2-1888679036-1756117428 | activity-core | unknown | 10 | 1 |
+| approval-engine | approval-engine | approval-engine | unknown | 10 | 1 |
+| argocd | argocd-applicationset-controller | railiance-enablement | unknown | 10 | 1 |
+| argocd | argocd-redis | railiance-enablement | unknown | 10 | 1 |
+| policy-nexus | policy-nexus | policy-nexus | unknown | 10 | 1 |
+| bao-notice | bao-notice | railiance-platform | unknown | 5 | 1 |
+| informed-decision | informed-decision | informed-decision | unknown | 5 | 1 |
+| mas | mas-statute | unknown | unknown | 5 | 1 |
+| state-hub | state-hub | state-hub | unknown | 5 | 1 |
+| cert-manager | cainjector | railiance-cluster | unknown | 0 | 1 |
+| cert-manager | cert-manager | railiance-cluster | unknown | 0 | 1 |
+| cert-manager | webhook | railiance-cluster | unknown | 0 | 1 |
+| databases | state-hub-db | rapp-postgres | unknown | 0 | 1 |
+| external-secrets | external-secrets | railiance-platform | unknown | 0 | 1 |
+| external-secrets | external-secrets-cert-controller | railiance-platform | unknown | 0 | 1 |
+| external-secrets | external-secrets-webhook | railiance-platform | unknown | 0 | 1 |
+| forgejo | forgejo-runner | railiance-forge | unknown | 0 | 1 |
+| kube-system | local-path-provisioner | railiance-cluster | unknown | 0 | 1 |
+| kube-system | svclb-mas-smtp-d86db2b1 | railiance-cluster | unknown | 0 | 1 |
+| kube-system | svclb-traefik-0c8aecaf | railiance-cluster | unknown | 0 | 1 |
+| kube-system | traefik | railiance-cluster | unknown | 0 | 1 |
+| target-revenue | target-revenue-pg | target-revenue | unknown | 0 | 1 |
+
+## STATE-WP-0091 preflight
+
+- ok: `True`
+- remaining_cpu_m: 395
+- note: Aggregate remaining millicores is not a kube-scheduler guarantee.
+- note: Preflight does not lower requests and does not start Helm.
+
+## Signal notes
+
+- Host resource:hosteurope:railiance01 and cluster resource:railiance:reef-railiance:k3s are the same 4 vCPU; do not add them.
+- Prometheus namespace_cpu:kube_pod_container_resource_requests:sum omitted Forgejo 100m on 2026-09-11; Kubernetes API is the scheduler-effective source.
+- node-exporter was disabled; host CPU usage is not a reservation and is not treated as spare capacity.
+- Zero-request pods are demand, not zero. Missing metrics are listed as gaps, not zeros.
+- STATE-WP-0091 preflight consumes state_hub_preflight_observation; residual millicores are not admission.
diff --git a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md
index 1840594..51a4f9c 100644
--- a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md
+++ b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md
@@ -421,3 +421,20 @@ and retained measurement provenance. Django/SQLite fixture timing is test
 coverage, not deployment sizing. Retain the existing two-user p95≤2s/no-failure
 criterion and separate document transfer measurements. Proposed allocations stay
 provisional until representative evidence and owner review support them.
+
+## Allocation baseline refreshed — 2026-10-19
+
+Read-only capture at 12:50:41Z verified the target node IP `92.205.62.239`
+before reusing the owner collector and reconciliation command. Retained evidence:
+`docs/evidence/2026-10-19-allocation-reconcile.{json,md}` and its provenance JSON.
+The current snapshot reports 4000m capacity, 3605m scheduled requests, no
+unscheduled pending requests, and 395m residual. The 60m Vergabe request is still
+present. This supersedes the old reservation snapshot for this review; it is
+neither measured spare CPU nor admission for a proposed resize.
+
+Thirteen grouped workloads have zero CPU request. Namespace ownership remains
+unknown for `mas`, `playwright` and `rapp-qonto`; workload names follow the owner
+collector's grouping labels. T03 must reconcile these with owner sources and
+representative demand before recommending a node budget. The successful
+STATE-WP-0091 preflight applies to its own modeled release sequence only.
+This capture changes no allocation and does not satisfy T02/T03/T04 acceptance.