Plan: decision recorded — refill after #342, do not migrate Choosing refill over migration removes both hazards that made the original plan a one-way door: no copy consistency window, and no copy-back on revert. Deferred until the mirror is clean, because migrating 1.8 GB of a mirror losing 39.6% of what it is handed relocates a known-bad copy.
Plan: give the event-log tier its own failure domain (not applied) Needs a data migration (1.8 GB / 3 files) and the env-var switch is a one-way door, so this stops at the plan per the owner gate. Notes that the writer uses pre-created PVCs rather than volumeClaimTemplates, so adding a volume is a normal mutable update -- but that the PVC must be Bound before anything references it, which is the exact #323 outage shape. Recommends deciding the mirror-drop issue (#342) first: migrating a mirror that is currently losing 39.6% of what it is handed moves a known-bad copy.