docs backend evidence cd ZD 04

ZD-04 — Rollout manifest and capacity hardening

Status: LOCAL_DONE / INTEGRATION_PENDING Validation: PASS (source); live apply/zero-diff and surge measurement OWED

B-BR-CD-ZD-06: A rollout admitted for surge must retain its serving replica, start at most one candidate, wait for readiness stabilization and refuse if any CPU/memory request/limit quota cannot fit the additional pod. Storage must already be independent. Unknown quantities or incomplete capacity data fail closed; quota is never raised automatically and surge failure must not fall back to stopping the old pod.

BUC-CD-ZD-04: After ZD-03 is applied and the owner approves a measured campaign, explicitly enable surge for that campaign. Read the current pod and quota under the deployment lock before migration; refuse missing room or remaining private-storage. Source default stays OFF until ZD-06 acceptance.

Tested parent ca7a7aba plus task. RED old 0/1 rollout fails the manifest assertion. GREEN manifest startup/readiness/min-ready/grace/pull-policy checks, capacity matrix (four independent exhausted resource dimensions, unknown and missing values, shared writer), and 218 agent assertions. The prior low-quota case now requires refusal before migration/image update; it cannot degrade an explicit surge campaign into a destructive single-pod rollout. make check-infra test-infra, shellcheck, actionlint, secret/diff review pass. No dependency added.

Desired API strategy is surge 1/unavailable 0, min-ready 10s, startup live probe, readiness 3s/2s/2, 60s grace, 10s delay + 10s shutdown; revision history 10. Web is unchanged (existing 25% rounding gives 1/0). Source agent default remains OFF; it requires storage separation and all quota dimensions when opted in. Source changes do not apply manifests or alter the running timer. Existing staging still uses its historical 0/1 strategy until the approved migration and measured rollout campaign; zero downtime remains unaccepted.