# m12p6 — TLS scale-up + HNSW graph persistence (✅ COMPLETE 2026-06-16)

Landed across `8e39ee1`, `4db3f1e`, `a039955` (2026-06-14→15), then `727fbfc`
and `44ec878` (2026-06-16). Changelog:
[CHANGELOG.md](../../../CHANGELOG.md). Milestone index: [README.md](README.md).
Backfilled record.

## What shipped

1. **Elasticity over REAL mTLS on k8s, for the first time.** A genuine
   `kubectl scale 3→5` exercised seed-join over mTLS on `kind`: joiners flip
   Ready in ~13 s via the m12p5 idle-readiness heartbeat, auto-promote to Voter,
   reach full content parity at lag 0, and scale-down loses **zero acknowledged
   DATA writes**.
2. **A six-bug chain fixed to get there** — each one a separate way TLS turns a
   working plaintext path into a silent failure:
   - `https://` seed scheme (a plaintext seed URL against a TLS listener),
   - rustls `CryptoProvider` install order (must be installed up front),
   - a headless seed Service (so a joiner can resolve peers before joining),
   - cold-handshake poll timeout,
   - two-tier cert-manager PKI,
   - the `grpc_tls_for` CA fallback for a joiner **not yet in the topology** —
     the bootstrap paradox: a node needs TLS to join, and joining is what puts it
     in the topology TLS is derived from.
3. **HNSW graph persistence + bounded SIGTERM drain** (`a039955`). Boot loads the
   persisted graph instead of rebuilding it, and a suspect graph is **skipped on
   reseed-pending close** rather than trusted — the fail-closed choice: a
   rebuild costs time, a silently corrupt graph costs correctness.
4. **7th edge** (`44ec878`): correct reseed seqno alongside the suspect-graph
   skip (rc11), plus the rc8+rc9 6-bug k3s 3-shard cluster repair (`727fbfc`).

## Evidence

- `tidal/tests/m12p6_graph_persistence.rs` (1),
  `tidal/tests/m12_reseed_term_marker.rs` (4).
- `tidal-server/tests/cluster_region.rs` (14).
- [docs/profiling/m12-cluster-deploy-findings.md](../../profiling/m12-cluster-deploy-findings.md)
  — the k3s deploy record, incl. the clean-slate 100k/1536 re-seed and the
  workspace test tallies at rc8.

## Carried forward

The reseed/readiness surface kept needing repair after M12 closed —
`c8ea05b`, `fe56d1b`, `973f073` (2026-06-18), `da736b8` (2026-08-20),
`5b3cfe5` and `7450cc7` (2026-08-21). Read m12p6 as "the scale-up path was
proven once, end to end, over real TLS", not as "the reseed state machine was
finished".