Migration PR 4 Stage 8: DNS cutover canonical baseline + 4h ramp holds

changelog.d/pr4-stage8-dns-cutover-canonical-baseline.added.md

@@ -0,0 +1,4 @@
+- Canonical ramp baseline (GAE-via-LB at 100/0, captured at the Stage 8 DNS cutover)
+  committed to `docs/migration/baselines/`; ramp runbook holds cut to ~4h with a
+  peak-window carve-out; rollback runbook records the at-cutover GAE certificate
+  expiry and the verified 5-minute DNS TTL.

docs/migration/baselines/canonical-gae-via-lb.json

@@ -0,0 +1,346 @@
+{
+  "completion_count": 0,
+  "completion_failure_count": 0,
+  "error_rate": 0.0,
+  "failure_count": 0,
+  "p50_completion_ms": null,
+  "p50_latency_ms": 322.55,
+  "p95_completion_ms": null,
+  "p95_latency_ms": 4096.66,
+  "probes": [
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 510.59,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 304.92,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3973.77,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 329.59,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 363.52,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3853.12,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 306.72,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 287.0,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3990.98,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 305.86,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 292.69,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3894.08,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 304.44,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 306.8,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3743.18,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 346.08,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 279.73,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3990.85,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 291.54,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 313.12,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3409.96,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 293.86,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 315.52,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 4096.66,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 253.89,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 314.87,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 8645.23,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 350.95,
+      "method": "GET",
+      "name": "liveness",
+      "ok": true,
+      "path": "/liveness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 274.4,
+      "method": "GET",
+      "name": "readiness",
+      "ok": true,
+      "path": "/readiness-check",
+      "status_code": 200
+    },
+    {
+      "completed": null,
+      "completion_ms": null,
+      "error": null,
+      "latency_ms": 3929.02,
+      "method": "GET",
+      "name": "us_metadata",
+      "ok": true,
+      "path": "/us/metadata",
+      "status_code": 200
+    }
+  ],
+  "request_count": 30,
+  "status_counts": {
+    "200": 30
+  }
+}

docs/migration/pr4-app-engine-rollback-runbook.md

@@ -77,12 +77,14 @@ are deliberately NOT embedded here — get them from, in order:
 
 Two clocks limit this option:
 
-1. **TTL**: propagation is bounded by the TTL recorded at Stage 7 (Squarespace floor;
-   expect ≥1h). Clients resolve back gradually, not at once.
+1. **TTL**: propagation is bounded by the record TTL — set to **300s (5 min)** at
+   Stage 7 and verified on public resolvers. Clients resolve back gradually, not at
+   once.
 2. **Certificate decay**: once DNS moves to the LB at Stage 8, App Engine's managed
-   certificate for `api.policyengine.org` stops renewing. Record its expiry at cutover
-   (typically ≤90 days out). **After that expiry, class (c) serves invalid TLS and is
-   dead** — the only path is fixing the LB forward and using class (a).
+   certificate for `api.policyengine.org` stops renewing. **Recorded at cutover
+   (2026-07-10): cert `38894749` expires 2026-08-22T19:09:24Z.** After that expiry,
+   class (c) serves invalid TLS and is dead — the only path is fixing the LB forward
+   and using class (a).
 
 After any (c) execution: the LB keeps running (no teardown under pressure); re-cutover
 follows the Stage 8 procedure once the failure is understood.