Record T02 cutover Option A and close design decision set

Staged per-repo promotion as primary plan; freeze-all emergency fallback only.
All WP-0005 T02 production choices are now decided.

docs/forgejo-production-decisions.md

@@ -17,7 +17,7 @@ Operator input: 2026-07-03
 | 5 | Package registry scope | **Multi-ecosystem (Option C):** OCI + **npm** + generic; PyPI/Go/Maven/Helm as inventory proves need | **decided** (2026-07-08) | OCI live; npm is launch requirement — see § Package scope |
 | 6 | Actions runner model | **In-cluster** on railiance01: `forgejo-runner` Deployment + DinD (`railiance01-build-01`) | **done** (2026-07-03) | Runner 2/2 Ready; coulombcore host runner disabled; `image-build` probe pushed OCI image via org secrets |
 | 7 | Backup target + retention | **Option A:** age-encrypted `forgejo dump` + `pg_dump` → **Nextcloud** WebDAV | **decided** (2026-07-09) | See § Backup; T04/T09 implementation |
-| 8 | Cutover mode | TBD (staged per-repo vs freeze-all) | open | — |
+| 8 | Cutover mode | **Option A:** staged per-repo promotion (no org-wide freeze) | **decided** (2026-07-09) | See § Cutover; tiers 0–2.5 + partial tier-3 proven |
 
 ## Hostname decision detail
 
@@ -53,8 +53,8 @@ remains canonical for git remotes until migration drills pass.
   (`glas-harness`) documents git/SSH/CI routing in
   `docs/forgejo-repo-migration-pilot-glas-harness.md`.
 - Remaining blockers for production cutover: **scheduled backup automation**
-  (T04/T09 per Option A), cutover mode confirmation (T02), npm/package
+  (T04/T09 per Option A), npm/package hardening (T07), and staged per-repo
-  hardening (T07), and production repo migration (`RAIL-HO-WP-0005-T11`).
+  migration execution (`RAIL-HO-WP-0005-T10` / `T11`).
 
 ## SMTP decision (IONOS) — 2026-07-07
 
@@ -161,10 +161,52 @@ daily logical backup.
 have succeeded **7 consecutive days** and one restore drill uses a Nextcloud
 artifact (not workstation `/tmp`).
 
+## Cutover decision (Option A) — 2026-07-09
+
+**Operator choice:** **Staged per-repo** promotion — continue the proven migration
+ladder; **no** org-wide freeze-all window.
+
+**Per-repo sequence (T11):**
+
+1. Gitea backup snapshot before promotion.
+2. Mirror/sync git to Forgejo if not already present.
+3. Verify Forgejo Actions and packages (OCI/npm per repo).
+4. Switch workstation `origin` → `forgejo-remote`; retain `gitea` legacy remote.
+5. Update State Hub `remote_url` and railiance01 sweep checkouts when promoted.
+6. Mark **that** Gitea repo read-only; do not delete (safety contract).
+7. Stabilization window before the next repo (operator judgment; `state-hub` used 7d).
+
+**Explicitly rejected for primary plan:** org-wide freeze-all cutover (Option B).
+Freeze-all remains documented only as an **emergency fallback** if staged drift
+becomes unacceptable — not the default path.
+
+**Rollback (per repo):** Re-point `origin` to `gitea-remote`; Forgejo copy becomes
+stale mirror. No Gitea repo deletes for ≥90 days after promotion. Gitea Helm stays
+until T12 explicit approval.
+
+**Gates before each tier-3 promotion:**
+
+- T09 automated daily backups: 7 consecutive successes (Option A).
+- T01 inventory classification for that repo (issues/wiki/LFS/packages).
+- Operator explicit approval for Wave-1 production repos (`CUST-WP-0054`).
+
+**Evidence:** tiers 0–2.5 complete; `glas-harness` pilot;
+`state-hub` cutover under `CUST-WP-0054-T05`.
+
+## T02 decision set — complete (2026-07-09)
+
+All Wave-1 production design choices for Forgejo are decided:
+
+| # | Topic | Option |
+| --- | --- | --- |
+| Hostname / exposure / deploy | decided 2026-07-03 |
+| SMTP | IONOS + OpenBao/ESO (T06 done) |
+| Package scope | Option C (OCI + npm + generic) |
+| Actions runner | In-cluster ADR-004 |
+| Backup | Option A (Nextcloud + age) |
+| Cutover | **Option A (staged per-repo)** |
+
 ## Open decisions (need operator input)
 
-1. ~~SMTP provider~~ — **done** (IONOS + T06 verified 2026-07-08)
+_All T02 items decided as of 2026-07-09._ Implementation tracks: T04/T09 backup
-2. ~~Package types~~ — **done: Option C** (OCI + npm + generic; others as needed)
+automation, T07 npm hardening, T10/T11 staged migration waves.
-3. ~~Actions runner~~ — **done** (in-cluster, ADR-004)
-4. ~~Backup destination~~ — **done: Option A** (Nextcloud + age; balanced retention)
-5. Cutover: staged project-by-project vs single freeze window