CUST-WP-0054 T01-T03: fleet architecture, de-hub runbook, drain plan

Documents the three-machine role model, fleet mesh topology, coulombcore
freeze policy, and ordered drain sequence. Adds railiance01 systemd tunnel
install assets and refreshes ops service inventory to reflect 2026-07-03
production placement (cluster State Hub, fleet mesh, draining coulombcore).

infra/fleet-mesh/install-railiance01.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Install fleet-mesh systemd user units on railiance01 (CUST-WP-0054-T02).
+set -euo pipefail
+
+REMOTE="${1:-railiance01}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+ssh "$REMOTE" 'mkdir -p ~/.config/bridge ~/.config/systemd/user ~/.ssh'
+scp "$SCRIPT_DIR/railiance01-tunnels.yaml" "$REMOTE:~/.config/bridge/tunnels.yaml"
+scp "$SCRIPT_DIR/systemd/"*.service "$REMOTE:~/.config/systemd/user/"
+scp "${HOME}/.ssh/id_ops" "${HOME}/.ssh/id_ops.pub" "$REMOTE:~/.ssh/"
+ssh "$REMOTE" 'chmod 600 ~/.ssh/id_ops ~/.config/bridge/tunnels.yaml'
+ssh "$REMOTE" 'sudo loginctl enable-linger tegwick 2>/dev/null || true'
+
+ssh "$REMOTE" bash -s <<'EOF'
+set -euo pipefail
+systemctl --user daemon-reload
+systemctl --user enable --now fleet-state-hub-coulombcore.service
+systemctl --user enable --now fleet-issue-core-coulombcore.service
+sleep 2
+curl -sf http://127.0.0.1:18000/state/health
+curl -sf http://127.0.0.1:18765/healthz
+systemctl --user --no-pager status fleet-state-hub-coulombcore.service fleet-issue-core-coulombcore.service
+EOF
+
+echo "Fleet mesh tunnels active on $REMOTE"

infra/fleet-mesh/railiance01-tunnels.yaml

@@ -0,0 +1,51 @@
+# Fleet-owned production tunnels on railiance01 (CUST-WP-0054-T02).
+# Install to: ~/.config/bridge/tunnels.yaml on railiance01
+#
+# Replaces workstation reverse tunnels state-hub-railiance01 and
+# issue-core-railiance01 with machine-local forward tunnels through coulombcore.
+#
+# activity-core bridge proxies (unchanged):
+#   actcore-state-hub-bridge  -> 127.0.0.1:18000
+#   actcore-issue-core-bridge -> 127.0.0.1:18765
+
+tunnels:
+  fleet-state-hub-coulombcore:
+    host: 92.205.130.254
+    remote_port: 8000
+    local_port: 18000
+    direction: local
+    remote_host: 10.43.170.94
+    ssh_user: tegwick
+    ssh_key: ~/.ssh/id_ops
+    actor: atm-fleet-mesh
+    health_check:
+      url: http://127.0.0.1:18000/state/health
+      interval_seconds: 30
+      timeout_seconds: 5
+    reconnect:
+      max_attempts: 0
+      backoff_initial: 5
+      backoff_max: 60
+
+  fleet-issue-core-coulombcore:
+    host: 92.205.130.254
+    remote_port: 8765
+    local_port: 18765
+    direction: local
+    remote_host: 10.43.103.154
+    ssh_user: tegwick
+    ssh_key: ~/.ssh/id_ops
+    actor: atm-fleet-mesh
+    health_check:
+      url: http://127.0.0.1:18765/healthz
+      interval_seconds: 30
+      timeout_seconds: 5
+    reconnect:
+      max_attempts: 0
+      backoff_initial: 5
+      backoff_max: 60
+
+actors:
+  atm-fleet-mesh:
+    class: atm
+    description: Railiance01 fleet mesh — direct production lanes to coulombcore cluster services

infra/fleet-mesh/systemd/fleet-issue-core-coulombcore.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Fleet mesh issue-core forward tunnel (railiance01 to coulombcore cluster)
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ssh -N \
+  -L 127.0.0.1:18765:10.43.103.154:8765 \
+  -i /home/tegwick/.ssh/id_ops \
+  -o ServerAliveInterval=10 \
+  -o ServerAliveCountMax=3 \
+  -o ExitOnForwardFailure=yes \
+  -o StrictHostKeyChecking=accept-new \
+  tegwick@92.205.130.254
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

infra/fleet-mesh/systemd/fleet-state-hub-coulombcore.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Fleet mesh State Hub forward tunnel (railiance01 to coulombcore cluster)
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ssh -N \
+  -L 127.0.0.1:18000:10.43.170.94:8000 \
+  -i /home/tegwick/.ssh/id_ops \
+  -o ServerAliveInterval=10 \
+  -o ServerAliveCountMax=3 \
+  -o ExitOnForwardFailure=yes \
+  -o StrictHostKeyChecking=accept-new \
+  tegwick@92.205.130.254
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target