CUST-WP-0054-T05 Phase 0 preflight evidence (baseline counts, dry-runs, image pull)

docs/state-hub-railiance01-cutover-plan.md

@@ -53,8 +53,9 @@ This is a **second cutover** in the pragmatic migration arc:
 - [x] T04 tier-3 production repos on Forgejo (images build in CI)
 - [x] Fleet mesh de-hub (T02) — production does not chain through workstation
 - [x] CUST-WP-0011 deploy handoff (`state-hub/deploy/railiance/`)
+- [x] **Phase 0 preflight** (2026-07-06) — `docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`
+- [x] CNPG + storage sign-off (Wave 2.1) — `local-path`, 75G free, operator healthy
 - [ ] **Operator approval** for freeze/final restore (constitution gate)
-- [ ] CNPG + storage sign-off (Wave 2.1)
 
 ## Target end state
 
@@ -96,15 +97,16 @@ WSL2: fallback only (CUST-WP-0011-T08/T09 retirement folds into T10)
 | 0.5 | Storage review | Confirm `local-path` (or chosen class) has ≥10Gi for `state-hub-db` PVC |
 | 0.6 | Operator approval | `POST /decisions/` or workplan note with approval id |
 
-Baseline totals to match at cutover (2026-07-06):
+**Recorded 2026-07-06 (Phase 0 complete):** see
+`docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`.
 
 ```text
-workstreams.total: 637
-tasks.total: 3983
-topics.total: 14
+workplans: 637        tasks: 3983         topics: 14
+progress_events: 8717 token_events: 1936   managed_repos: 74
+decisions: 79
 ```
 
-Extend with explicit `pg_catalog` table counts for `workplans`, `tasks`, `progress_events`, `managed_repos`, `token_events` (same set as CUST-WP-0011-T07).
+Post-restore counts on railiance01 must match exactly.
 
 ### Phase 1 — Deploy empty stack on railiance01
 

docs/state-hub-railiance01-cutover-preflight-2026-07-06.md

@@ -0,0 +1,109 @@
+# T05 Phase 0 Preflight Evidence — 2026-07-06
+
+Workplan: `CUST-WP-0054-T05`  
+Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
+`no_secret_material_recorded: true`
+
+## Checklist
+
+| Step | Action | Result | Evidence |
+| --- | --- | --- | --- |
+| 0.1 | Baseline API totals | **pass** | See § API summary below |
+| 0.2 | Per-table PG counts (coulombcore) | **pass** | See § Table counts below |
+| 0.3 | Forgejo image pull (railiance01) | **pass** | `main-f9f0091` + `latest` @ `sha256:0b62f2d530cf7` |
+| 0.4 | Manifest dry-run (railiance01) | **pass** | Server + client dry-run exit 0 |
+| 0.5 | Storage / CNPG review | **pass** | `local-path` default; 75G free on `/`; CNPG healthy |
+| 0.6 | Operator approval | **pending** | Required before Phase 2 freeze |
+
+## API summary (`GET /state/summary` @ 2026-07-06T16:06:15Z)
+
+```json
+{
+  "topics": { "total": 14 },
+  "workstreams": { "total": 637, "active": 11, "finished": 582 },
+  "tasks": { "total": 3983, "todo": 88, "progress": 4, "done": 3696 },
+  "decisions": { "total": 79, "open": 1, "resolved": 76 }
+}
+```
+
+Full artifact: captured at preflight run from `http://127.0.0.1:8000/state/summary`.
+
+## Table counts — coulombcore `state-hub-db` (production writer)
+
+Queried via `kubectl exec` on `databases/state-hub-db-1` as `postgres`:
+
+| Table | Count | CUST-WP-0011-T07 reference |
+| --- | ---: | --- |
+| `workplans` | 637 | was 633 at 2026-07-03 cutover |
+| `tasks` | 3983 | was 3964 |
+| `progress_events` | 8717 | was 8192 |
+| `topics` | 14 | was 14 |
+| `token_events` | 1936 | was 1933 |
+| `managed_repos` | 74 | — |
+| `decisions` | 79 | — |
+
+**Cutover gate:** post-restore counts on railiance01 must match this table exactly.
+
+## Production deployment (coulombcore, source of dump)
+
+| Item | Value |
+| --- | --- |
+| API image | `gitea.coulomb.social/coulomb/state-hub:f2e042a` |
+| API pod | `state-hub/state-hub-7d565cddf4-jnpfw` Running |
+| CNPG cluster | `databases/state-hub-db` — healthy, 11d |
+| ClusterIP | `10.43.170.94:8000` |
+| Workstation access | ops-bridge `state-hub-primary` → above Svc |
+
+## Target image (railiance01 deploy)
+
+| Tag | Digest | Notes |
+| --- | --- | --- |
+| `forgejo.coulomb.social/coulomb/state-hub:main-f9f0091` | `sha256:0b62f2d530cf7` | CI build from tier-3 promotion |
+| `forgejo.coulomb.social/coulomb/state-hub:latest` | same | Alias |
+| `:f9f0091` | **not found** | Use `main-f9f0091` or `latest` in Helm values |
+
+## railiance01 platform readiness
+
+| Check | Status |
+| --- | --- |
+| CNPG operator (`cnpg-system`) | Running |
+| Existing CNPG clusters | `forgejo-db`, `net-kingdom-pg` healthy |
+| `state-hub` namespace | Does not exist (expected — Phase 1 creates) |
+| `state-hub-db` on railiance01 | Not deployed (expected) |
+| StorageClass | `local-path` (default) |
+| Node disk | 75G available on `/` (96G volume, 23% used) |
+| Sweep hostname | `239.62.205.92.host.secureserver.net` |
+| Partial clone tree | `/home/tegwick/activity-core`, `llm-connect`, … |
+
+## Dry-run output summary
+
+```bash
+cd ~/state-hub
+KUBECONFIG=~/.kube/config-hosteurope make railiance-state-hub-server-dry-run  # exit 0
+KUBECONFIG=~/.kube/config-hosteurope make railiance-state-hub-client-dry-run   # exit 0
+```
+
+Server dry-run created (dry-run): `state-hub-db-credentials`, `state-hub-db` Cluster,
+DB NetworkPolicies, `state-hub` Namespace, `state-hub-env`, ConfigMap, Service, Deployment.
+
+## Phase 1 readiness
+
+Phase 0 is **complete except operator approval (0.6)**. Phase 1 may proceed without
+approval (empty stack deploy). Phase 2 freeze/restore **requires** explicit approval.
+
+### Recommended Helm image pin for Phase 1
+
+```yaml
+image:
+  repository: forgejo.coulomb.social/coulomb/state-hub
+  tag: "main-f9f0091"
+```
+
+Update `state-hub/deploy/railiance/apps/helm/state-hub-values.yaml` and promote
+to `railiance-apps` before or during Phase 1.
+
+## Open items carried to Phase 1
+
+1. Create SOPS-backed `state-hub-db-credentials` on railiance01 (platform)
+2. Create `state-hub-env` Secret with `DATABASE_URL` pointing at railiance01 CNPG rw svc
+3. Confirm image pull secret if Forgejo registry requires auth from cluster (currently pulls anonymously)