docs: refresh Indee delivery and integrated UI checkpoint

docs/SESSION-HANDOVER-20261007.md

@@ -11,13 +11,29 @@ Read **Current live checkpoint** first. Older receipts below apply only to their
 
 ### Latest continuation checkpoint (read before older bullets)
 
-- **Newest continuation:** Indee operation `8b53579c…` passed all seven writer
+- **Newest continuation:** controlled native cutover `8b53579c` and same-boot
-  drain/exit proofs; backup verification and successful cutover remain in progress.
+  post-target rollback `5bd06edc` both passed, including independent final checks.
-  Prior `f39bd824` native recovery finished autonomously after observer timeouts;
+  Cutover committed with cleanup complete, maintenance Released, all seven exact
-  independent final checks passed. Same VM was safely paused for compilation,
+  target images/saved units and new runtime IDs, fresh database/four-volume
-  then resumed and passed nine readiness probes including the exact died-event
+  restore proofs and no holds. Evidence: `daea20bc` and
-  query. Only its owned transient unit received best-effort MemoryLow=3GiB;
+  [managed-update-recovery-implementation.md](managed-update-recovery-implementation.md).
-  MemoryMin/swap limits and all other services are unchanged. Reset on cleanup.
+  The qualification VM shut down cleanly; temporary MemoryLow was reset to zero.
+- **Yaya worker image is imported, not activated:** `6afb6abc` records exact
+  qualified archive/blob/image verification and preserved live state across the
+  inert import. All 30 existing container identities/start times/statuses,
+  identity/session, operator intent, management service and catalogs matched.
+  Frontend/API images were already staged; fresh read-only preflight confirmed
+  all seven legacy members running and original Quadlet hashes unchanged.
+  Receipt: [indeehub-worker-runtime-20261008.md](indeehub-worker-runtime-20261008.md).
+- **Production build remains in progress:** agent checkpoint reports optimized
+  session `73204` past lightning/cashu and compiling mainline/totp/lofty
+  dependencies, without reported errors; the main binary is not yet compiled.
+  There is no completed production artifact or backend deployment. The prepared
+  inert staging/API-pin runner awaits that artifact; existing-node registration
+  pin, fresh exact live plan, reviewed source/mirror gates and signed catalog
+  remain required before activation. Operator signing is prepared and checked,
+  **not performed**; no new signing request or Yaya deployment has occurred.
+  Cloud/VPN builds remain queued behind the delivery-critical build.
 - Firewall UI is integrated through `a1bc6426`: full width, standard black entry,
   right-aligned statuses, unchanged Network background, shared header/BackButton,
   verified-capability private reads and separate requests across view generations.
@@ -25,17 +41,21 @@ Read **Current live checkpoint** first. Older receipts below apply only to their
   four-width source browser qualification passed. Not deployed. Isolated new VPN
   backend compilation stopped on an omitted existing JSON fixture before tests;
   missing inputs are now materialized, but no pass is claimed.
-- Combined dashboard snapshot: `/tmp/archy-integrated-ui-qualified-20261008`,
+- Combined dashboard snapshot: `/tmp/archy-integrated-ui-qualified-v2-20261008`,
-  781 tracked inputs. Delta gate verifies all34 changes against the qualified
+  781 tracked inputs. Delta gate passes all 36 reviewed changes against the
-  1,459-test Fleet baseline map exactly to reviewed File Browser, connection and
+  qualified 1,459-test Fleet baseline, including the two additional files from
-  firewall slices. Typecheck/build still pending. Runner:
+  main ancestry integration `8d70d031`. Six retained PiP checks passed; receipts:
-  `/tmp/archy-integrated-ui-20261008.py`; delta gate:
+  `/tmp/archy-retained-pip-main-20261008.log` and matching `.json`. Gate script:
-  `/tmp/archy-integrated-ui-delta-gate.py`. No build was started during VM work.
+  `/tmp/archy-integrated-ui-delta-gate-v2.py`. Combined typecheck/production UI
+  build remain pending behind the optimized backend build. Candidate includes
+  main ancestry through `8d70d031`; actual local main was not changed.
 - Existing ngit proposal `8f394251` remains **draft**, updated by normal fast-forward
   from `e97f958f` to `cf3c38bed009edd729f908b452913a7a1a8e0b67`; advertised tip verified.
   Its title is now “Post-1.9.0 recovery, private IndeeHub delivery and dashboard
   follow-ups”, with exact updated cover note verified. No duplicate PR, force push,
-  accepted-main merge, release or catalog activation occurred. `cf3c38be` joins
+  accepted-main merge, release or catalog activation occurred. The draft remains
+  at `cf3c38be`, behind the latest candidate; it is not current candidate
+  publication. `cf3c38be` joins
   existing proposal ancestry with zero tracked content change. Required mirror
   check after source publication still fails only local main mismatch; retained
   log `/tmp/archy-post190-mirror-check-20261008.log`. Do not claim main parity or
@@ -47,6 +67,8 @@ Read **Current live checkpoint** first. Older receipts below apply only to their
   Cloud Libraries backend/UI remain isolated, uncompiled and not enabled.
 
 
+### Earlier checkpoint snapshots (historical; superseded above)
+
 - Latest actual attempt `5bd06edc…` reached target startup but failed; native
   rollback and independent **same-boot** verification passed: all seven restored
   runtimes, exact image/unit pins, writable-layer sentinels, database/volume

docs/indeehub-private-delivery-runbook-20261008.md

@@ -1,9 +1,11 @@
 # IndeeHub private Yaya delivery — 8 October 2026
 
-Status: prepared, **not activated**. This is private free/authenticated app testing;
+Status: worker image staging completed; production build in progress; **not activated**.
+This is private free/authenticated app testing;
 paid viewing, publication and payment UAT remain separate. No funds or public
-announcements are authorized by this runbook. No Yaya command has been executed
+announcements are authorized by this runbook. Separately authorized inert Yaya
-by preparing it.
+worker import and read-only preflight are completed (`6afb6abc`); no backend
+deployment, app lifecycle change or catalog activation has occurred.
 
 ## Frozen inputs and prerequisite evidence
 
@@ -16,7 +18,9 @@ by preparing it.
   natively recovered cleanly; that failure is retained separately.
 - Matching optimized backend build is in progress against all536 unchanged
   backend inputs from the 2,031-test snapshot. Do not substitute the test-profile
-  executable as the production artifact.
+  executable as the production artifact. Latest agent checkpoint for session
+  `73204`: past lightning/cashu, compiling mainline/totp/lofty dependencies with
+  no reported errors; main binary not yet compiled. No finished artifact exists.
 - Unsigned delivery catalog: worker runtime evidence directory,
   `unsigned-full-candidate-with-worker-29627fc.json`, SHA256
   `9967d06c8809d69cce6057b9f45a630e9ce21fd5cd33541e352e23336cd8eb07`.
@@ -24,14 +28,25 @@ by preparing it.
   `64015f79ca84c604cecd22e9e4a892644d485988f163c01e3d47277a64282747`.
 - Existing frontend/API import evidence is in
   `~/.local/state/archipelago/session-recovery/indeehub-yaya-private-staging-5d0ea64/`.
-  Worker import is prepared only; its qualified OCI SHA256 is
+  Worker import is complete (`6afb6abc`): qualified OCI SHA256
   `6db29188c0e68ed8e9e8d84ea2e9c5c70695518e0930775bf6b3200d14d99527`.
+  Exact archive/blobs/image were verified; all 30 existing container identities,
+  start times/statuses, node identity/session, operator intent, management service
+  and catalogs were preserved. Receipt:
+  `~/.local/state/archipelago/release-qualification/worker-runtime-29627fc-20261008/yaya-worker-import-receipt-20261008.json`.
+  This is inert staging, not an app update or signed catalog selection.
 - Preserve historical catalog signatures and all old failure journals. Require
   reviewed local/ngit/Gitea main and applicable release refs to match before
   catalog activation. Parent owns source acceptance and signature coordination;
   check the existing signature request before requesting a new one.
 
-## Read-only preflight before any Yaya mutation
+## Fresh preflight before delivery mutations
+
+The retained fresh inventory is
+`~/.local/state/archipelago/release-qualification/indeehub-yaya-fresh-preflight-20261008/`.
+It confirmed all seven legacy members running, original Quadlet hashes unchanged
+and frontend/API pins matching their import receipt. Refresh relevant bindings
+before generating/applying the final plan; an earlier snapshot is not a lease.
 
 1. Verify actual hostname `yaya-server`, rootless Podman owner/storage, current
    backend artifact/helper hashes and free durable disk capacity. The qualified
@@ -55,8 +70,10 @@ by preparing it.
 The offline draft planner is in
 `~/.local/state/archipelago/release-qualification/indeehub-delivery-tools-20261008/`.
 It explicitly reports `activation_ready=false`: its original-state inputs are
-archived, public registration pins are unresolved, and signature/import/live
+archived, public registration pins are unresolved, and signature/final live
-checks remain open. Draft SHA256
+plan checks remain open. The earlier draft predates the completed worker import;
+its false readiness flag is preserved rather than presented as a current import
+failure. A new plan must bind fresh live evidence. Draft SHA256
 `aae8cdeca470b30481042c62f040435aa2292180cb54f0f4496d86a2204c4b8b`.
 All three delivery image pins and frontend hooks match the frozen candidate.
 This corrects an old planner assumption that would otherwise retain the legacy
@@ -64,9 +81,13 @@ worker. It is preparation, not an executable deployment authorization flag.
 
 ## Qualified activation sequence
 
-After full cutover qualification and source/signature gates, import only the
+Native success/rollback qualification and inert worker import are complete.
-qualified worker with the reviewed importer, recording that app runtimes,
+Do not repeat import merely because the earlier prepared plan still records false
-identity/session, intents, management service and catalogs are unchanged.
+flags. Reverify the exact staged alias/digest against its receipt before delivery.
+After the production artifact finishes and passes its frozen-input/hash checks,
+prepare its reviewed inert staging and existing-node API registration pin using
+`/tmp/indeehub-stage-production-and-prepare-pin.py`; that step remains pending.
+Finish source/mirror/signature gates and review the fresh seven-member plan.
 Deploy the reviewed matching backend/helper artifact through the existing
 preserving deployment procedure. Install only the exact reviewed plan and
 verified signed private candidate; preserve previous catalog/drop-in bytes.