AP-SPEC-066 Epic 4: gateway readiness, outage controls and recovery operations

[bordumb]

Doctor previously checked isolation without deriving full production readiness, and emergency disable depended on a running gateway. It now reports the required typed checks and refuses unready deployments. Store-only disable/revoke durably stop admission during runtime, custody and qualification outages without claiming drainage or credential deletion.

The change also provides a bounded, canary-scanned support bundle; operator-process rotation with distinct runtime-reader and operator-writer identities and durable exact-generation cleanup notes; SIGTERM session drainage; and independently retained connection floors that reject restored older or substituted records before lease. Damaged floor generations and digests refuse without being silently repaired. Python and TypeScript preserve the refusal codes. Support collection bounds an unresponsive admin-status request and reports unavailable facts explicitly. Clock readiness requires a regular, safely writable synchronization marker no more than fifteen minutes old; the packaged reference caps polling at five minutes.

The source-free operator archive contains the release binaries, reviewed systemd reference and operations runbook. Hosted checks exercise the extracted binary, application UID isolation, PostgreSQL multi-host lifecycle and a physical backup plus WAL restore to a named point. The runbook covers signer/root rotation, expiry/revocation, secret rotation, restore, unknown reconciliation and rolling upgrades.

Validation: at f1f92c3f, main CI passed every job, including the authoritative suite, Lean, Kani, formal evidence and CI qualification. Operator packaging/isolation, PostgreSQL lifecycle qualification, SDK recipes, and Python/TypeScript package workflows also passed. Required generated closures, inventories and frozen evidence were refreshed with repository generators. Protected live custody still awaits environment approval; production/live acceptance remains open.

The operator artifact run supplies the verified trial input at f1f92c3f. Downloaded archive SHA-256: 70b585794b4883a9f85897446bf13ccc334d711570b0dee3148413788f577cd4; all 11 payload digests match. It is an unsigned trial artifact and makes no recipe-qualification claim.

Epic 4 acceptance remains open for the live production reference/runbook exercise and independent unfamiliar-operator trial, including defect reruns. Disposable automated exercises do not close those human/live gates. Epic 5 qualification and release acceptance are not claimed.