docs backend evidence cd ZD 07

ZD-07 — Remaining live acceptance and drill protocol

Status: LIVE_ACCEPTANCE_OWED Validation: NOT_RUN (live drills)

No deliberately broken commit, invalid image, contract-floor change, restored dump rehearsal or rollback drill was introduced into signed main lineage. The attached execution prompt requires a separate explicit owner yes for each live change and an owner-selected signed drill mechanism. This source PR does not authorize or certify those operations. ZD-08 source preparation can proceed independently; it consumes no live-drill acceptance.

1. Data rehearsal: restore a verified staging dump to an exclusive disposable PostGIS; apply/check the signed migration chain, verify checksums and the out-of-order historical window. Never use or mutate the live database for the rehearsal. Record only counts/digests and the signed release identity.
2. Unattended delivery: associate two distinct main merge SHAs with signed release workflows and deployed receipts, with no manual action between merge and smoke. ZD-00 proves current/no-change polling, not this criterion.
3. Broken image: owner selects a reviewed mechanism on signed main lineage before any destructive fixture exists. Run the full public/availability probe; candidate stays unready, old pod serves, pinned rollback restores the previous revision, current remains unchanged, failure receipt and rejected latch exist. Do not substitute local harness success for this drill.
4. Contract floor: separately approve a signed fixture whose target floor is above the deployed compatibility floor. Require refusal before backup, migration or image mutation and an unchanged current receipt.
5. Landing rollback: separately approve the fault injection and recovery. Verify post-switch smoke failure restores the original relative symlink, previous release remains, images return to the pinned original revision, current stays unchanged and no schema is rolled back.
6. Hold/pause: after an individually approved rollback-failure fixture, require durable hold, zero later actions, explicit recovery then release-hold. Pause uses systemctl disable --now abastevo-deploy-agent.timer; inspect the service because stopping the timer does not cancel an in-flight run. Enabling the timer again is a separate approved change.

Each approval must name its effect and rollback, only in abastevo-temp and the existing Abastevo vhost. Keep private dumps, descriptors and connection details outside Git; retain sanitized receipts for successes and failures. Never delete storage/namespace/PVC/PV/StatefulSet or change another application.