docs: record verified staging rollout

docs/local-hardening-plan.md

@@ -127,3 +127,11 @@ The goal remains open while any row lacks reproducible local evidence.
   and retained an empty application-table count diff. The scoped project,
   volume, networks, and one-run image were removed; the ordinary Compose
   project stayed on its original image and migration level.
+- After explicit approval for the development rollout, a fresh backup passed
+  its restore drill and the ordinary Compose project was upgraded from 8 to all
+  10 migrations at application commit `143e159`. Its full application-table
+  snapshot had an empty before/after diff. The current two-web/two-worker
+  release then passed local health, four-node cluster/PubSub, public HTTPS/TLS,
+  WebSocket Upgrade, post-rollout log scanning, and headed-Chrome Russian
+  localization and authorization-boundary checks. Evidence is retained under
+  ignored `output/staging-rollout/20260719093528-3223196/`.

docs/verification.md

@@ -305,6 +305,35 @@ absent after cleanup. Evidence is retained at
 container IDs, 8-migration state, and user/request/message counts remained
 unchanged.
 
+After explicit approval to update the development Compose project, application
+commit `143e159` was deployed on 2026-07-19. Immediately before the rollout, a
+new mode-`0600` custom-format backup was created at
+`output/backups/compose-20260719-093528.dump`; its SHA-256 is
+`fd5f293c63972b19af9bc967ea229cc2617c17ad32d5fcd695f2dafafef4d790`.
+The archive passed the isolated restore drill before any source-database
+migration.
+
+The ordinary Compose migration job then advanced the source database from 8 to
+all 10 current migrations and started two web and two worker replicas from
+image
+`sha256:6685247b8e872ade5e36f2b9e88bfca09b1606823ffb3e4f1469fbcfdc15d48c`.
+The complete before/after application-table snapshot had an empty diff,
+including the existing 2 users, 1 request, 7 messages, 1 assignment, and 4
+ended tracking sessions. Post-rollout catalog checks found the localized
+category-description column and all 11 valid cursor indexes. Local live and
+readiness checks, the four-node cluster/PubSub probe, public home, Safety,
+live/readiness, TLS verification, and a WebSocket Upgrade all passed. The
+checked web/worker log window contained no application error, warning,
+exception, deadlock, or HTTP 5xx match.
+
+Headed Chrome then rendered the updated Safety page in English and Russian,
+redirected the protected Requests route to the Russian login form with the
+expected authorization notice, and reported zero console errors or warnings.
+The visible browser was deliberately left open. Mode-`0600` rollout evidence
+is retained under
+`output/staging-rollout/20260719093528-3223196/`; the browser screenshot is
+retained under ignored `.playwright-cli/`.
+
 After the Activity rollout, headed Chrome rendered the updated public
 navigation, followed the Activity link to the authenticated route, and received
 the expected login redirect and flash with zero console errors or warnings.
@@ -451,13 +480,13 @@ The complete local regression was repeated against application commit
   restore, corrupted-repository rejection, and interruption without a snapshot.
   Temporary buckets/databases/containers were absent afterward, the obsolete
   retained bucket was removed, and only the final canonical bucket remains.
-- The ordinary public-facing Compose project was checked read-only: local
-  live/readiness, four-node PubSub, public HTTPS home/Safety/readiness, DNS, and
-  TLS passed. Its current database was backed up and restore-tested through all
-  10 source migrations, then ran the current 2-web/2-worker release on an
-  isolated restored copy with an empty application-table diff and passing
-  HTTP/cluster/PubSub checks. Its own existing rows, migration level, and
-  running application containers remained unchanged.
+- The ordinary public-facing Compose project first passed read-only
+  live/readiness, cluster/PubSub, public HTTPS, DNS, TLS, backup/restore, and
+  isolated upgrade rehearsal checks. After explicit approval, it was backed up
+  again, migrated from 8 to 10 migrations, and replaced with the current
+  2-web/2-worker release. Its application-table count diff remained empty;
+  schema, health, cluster/PubSub, public HTTP/TLS/WebSocket, logs, localization,
+  and the protected-route browser flow passed after rollout.
 
 ## Known work before a public production launch