feat(deploy+stress): m11p6/mTLS deploy fixes — HTTPS probes + TLS-aware generator

Deploying the m11-44b768b image (p6 sharding + p7 mTLS + p8 ops + p9 correctness)
surfaced two blockers; both fixed here.

1. statefulset.yaml: the m11p7 change made the :9500 HTTP plane serve TLS, but the
   startup/liveness/readiness probes still used scheme HTTP — kubelet got a TLS
   handshake back ("malformed HTTP response \x15\x03\x03") and pods never went
   Ready. Set scheme: HTTPS on all three probes (kubelet skips cert verification
   for httpGet probes, so the cert's DNS-only SANs are fine). Image pinned to the
   m11-44b768b amd64 digest.

2. tidal-stress: the generator's reqwest client did default cert verification and
   had no way to trust the cluster's private CA, so https:// targets failed. Added
   --ca-cert <pem> (verified TLS against the mounted tidaldb-cluster-tls ca.crt)
   and --insecure (skip verification, escape hatch). New StressError::CaCert for
   the PEM read fault.

stress-job-m11p6-baseline.yaml: T2-A-equivalent quorum-write throughput run on the
new stack — https:// targets, ca.crt mounted from the tidaldb-cluster-tls Secret,
--ca-cert verified TLS. Drops the removed --write-path flag (m11p6 unified the
write path to hash-routing).

k8s/cluster/statefulset.yaml

@@ -81,7 +81,7 @@ spec:
               mountPath: /data
       containers:
         - name: tidaldb
-          image: registry.threesix.ai/tidal/server@sha256:173e803082beea479c48f3729f998e7332766ebcef55786da12f15719648f4fa  # m11p5
+          image: registry.threesix.ai/tidal/server@sha256:8b136de21b969adedee37fdcb0cac15ecdd77b9beb5c5f31be3a5d15340323b1  # m11-44b768b (p6 sharding + p7 mTLS + p8 ops + p9 correctness)
           imagePullPolicy: IfNotPresent
           # The image ENTRYPOINT is the bare binary. We override the command with
           # a tiny /bin/sh wrapper (the bookworm-slim runtime HAS a shell) so we
@@ -164,16 +164,21 @@ spec:
           # A restarted PVC-retained voter is Ready on today's terms (no
           # regression). The full predicate is documented in the kubernetes.md
           # runbook so probe behavior is diagnosable.
+          # m11p7: the HTTP plane on :9500 serves TLS (inter-node mTLS), so every
+          # probe must use scheme HTTPS. kubelet does NOT verify the server cert
+          # for httpGet probes, so the cert's DNS-only SANs (no pod IP) are fine.
           startupProbe:
             httpGet:
               path: /health/startup
               port: http
+              scheme: HTTPS
             periodSeconds: 5
             failureThreshold: 60     # ~5 min for large-DB WAL replay / index load
           livenessProbe:
             httpGet:
               path: /health/live
               port: http
+              scheme: HTTPS
             periodSeconds: 10
             timeoutSeconds: 3
             failureThreshold: 3
@@ -181,6 +186,7 @@ spec:
             httpGet:
               path: /health          # cluster-aware: 503 joiner/quarantined/draining
               port: http
+              scheme: HTTPS
             periodSeconds: 10
             timeoutSeconds: 3
             failureThreshold: 3

tidal-stress/k8s/stress-job-m11p6-baseline.yaml

@@ -0,0 +1,97 @@
+# m11p6 baseline — quorum-write throughput over the mTLS plane (m11p7).
+# First run on the m11-44b768b image: confirms the HTTPS :9500 client plane,
+# cluster-key auth, and m11p6 single-group replication all carry a real write
+# load end-to-end, and re-establishes the T2-A capacity number on the new stack.
+#
+# TLS: the :9500 plane serves a private-CA cert (tidaldb-cluster-tls). The
+# generator trusts it via the mounted ca.crt (--ca-cert) — verified TLS, not
+# --insecure. Targets MUST be https:// and use the cert's DNS SANs (pod-DNS / VIP),
+# never pod IPs (not in the SAN list).
+#
+# Apply:  kubectl apply -f tidal-stress/k8s/stress-job-m11p6-baseline.yaml
+# Watch:  kubectl logs -f job/tidal-stress-m11p6 -n tidaldb-cluster
+# Rearm:  kubectl delete job tidal-stress-m11p6 -n tidaldb-cluster
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: tidal-stress-m11p6
+  namespace: tidaldb-cluster
+  labels:
+    app.kubernetes.io/name: tidal-stress
+    app.kubernetes.io/part-of: tidaldb
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 7200
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tidal-stress
+        app.kubernetes.io/part-of: tidaldb
+    spec:
+      restartPolicy: Never
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: stress
+          image: registry.threesix.ai/tidal/stress@sha256:e130aa871f5df17a14a9e13e7df606c602b95a03d8eba49490ff7481e6e2b2b3  # m11-44b768b (TLS-aware)
+          imagePullPolicy: IfNotPresent
+          args:
+            - --target
+            - https://tidaldb-0.tidaldb-peers.tidaldb-cluster.svc.cluster.local:9500
+            - --target
+            - https://tidaldb-1.tidaldb-peers.tidaldb-cluster.svc.cluster.local:9500
+            - --target
+            - https://tidaldb-2.tidaldb-peers.tidaldb-cluster.svc.cluster.local:9500
+            - --leader-url
+            - https://tidaldb.tidaldb-cluster.svc.cluster.local:9500   # VIP — routes to any ready pod; m11p6 hash-routes writes to the group leader
+            - --ca-cert
+            - /etc/tidaldb/tls/ca.crt
+            - --ack
+            - quorum
+            - --ramp
+            - peach-100k
+            - --stage-secs
+            - "120"
+            - --mix
+            - writes
+            - --corpus
+            - "20000"
+            - --users
+            - "100000"
+            - --poll-status
+          env:
+            - name: TIDAL_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: tidaldb-credentials
+                  key: TIDAL_API_KEY
+            - name: TIDAL_STRESS_LOG
+              value: warn
+          resources:
+            requests:
+              cpu: 250m
+              memory: 256Mi
+            limits:
+              cpu: "3"
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: cluster-tls
+              mountPath: /etc/tidaldb/tls
+              readOnly: true
+      volumes:
+        - name: cluster-tls
+          secret:
+            secretName: tidaldb-cluster-tls
+            items:
+              - key: ca.crt
+                path: ca.crt

tidal-stress/src/client.rs

@@ -45,8 +45,10 @@ impl HttpClient {
         request_timeout: Duration,
         api_key: Option<String>,
         ack: Option<String>,
+        ca_cert: Option<String>,
+        insecure: bool,
     ) -> Result<Self> {
-        let inner = reqwest::Client::builder()
+        let mut builder = reqwest::Client::builder()
             .timeout(request_timeout)
             .connect_timeout(Duration::from_secs(5))
             // Warm-connection pool sized to comfortably saturate the server's
@@ -54,9 +56,21 @@ impl HttpClient {
             // 4 host-pools (≈4×256 idle ceiling).
             .pool_max_idle_per_host(256)
             .pool_idle_timeout(Duration::from_secs(90))
-            .tcp_nodelay(true)
+            .tcp_nodelay(true);
-            .build()
+        // m11p7: the cluster's :9500 plane serves TLS from a private CA. Trust it
-            .map_err(StressError::Client)?;
+        // via the mounted ca.crt (verified), or skip verification with --insecure.
+        if let Some(path) = ca_cert {
+            let pem = std::fs::read(&path).map_err(|source| StressError::CaCert {
+                path: path.clone(),
+                source,
+            })?;
+            let cert = reqwest::Certificate::from_pem(&pem).map_err(StressError::Client)?;
+            builder = builder.add_root_certificate(cert);
+        }
+        if insecure {
+            builder = builder.danger_accept_invalid_certs(true);
+        }
+        let inner = builder.build().map_err(StressError::Client)?;
         // Build the Authorization header once. reqwest's `bearer_auth` does a fresh
         // `format!("Bearer {token}")` allocation plus a HeaderValue validation pass
         // on EVERY call, over a token that never changes — pure per-request waste.

tidal-stress/src/error.rs

@@ -31,6 +31,14 @@ pub enum StressError {
     #[error("http client build failed: {0}")]
     Client(#[source] reqwest::Error),
 
+    /// The `--ca-cert` PEM bundle could not be read (an IO/disk fault).
+    #[error("could not load --ca-cert {path}: {source}")]
+    CaCert {
+        path: String,
+        #[source]
+        source: std::io::Error,
+    },
+
     /// The provided API key could not be turned into an HTTP `Authorization`
     /// header value (contains control or non-visible characters).
     #[error("invalid api key: {0}")]

tidal-stress/src/main.rs

@@ -49,6 +49,17 @@ struct Cli {
     #[arg(long, env = "TIDAL_API_KEY")]
     api_key: Option<String>,
 
+    /// PEM CA bundle to trust for HTTPS targets (m11p7: the cluster's :9500 plane
+    /// serves TLS from a private CA). Point at the mounted `ca.crt` from the
+    /// `tidaldb-cluster-tls` Secret. Verified TLS — preferred over --insecure.
+    #[arg(long)]
+    ca_cert: Option<String>,
+
+    /// Skip TLS certificate verification for HTTPS targets. An escape hatch for
+    /// quick in-cluster runs; use --ca-cert for real verification.
+    #[arg(long, default_value_t = false)]
+    insecure: bool,
+
     /// Write acknowledgment mode sent as `x-tidal-ack` on every write
     /// (m11p3: leader|quorum). Omitted = the cluster's topology default.
     #[arg(long)]
@@ -201,6 +212,8 @@ async fn run() -> Result<()> {
         Duration::from_secs(cli.request_timeout_secs),
         cli.api_key.clone(),
         cli.ack.clone(),
+        cli.ca_cert.clone(),
+        cli.insecure,
     )?);
 
     // The seed URL anchors corpus seeding (any gateway accepts items and