registry.threesix.ai/tidal/server:m12-admin-gate-20260823@sha256:6e220060a342
658b734d258245b20f6233d96e26415b3a44956b1c3bceebe48c, built from c9adec0.
This is the image that finally puts 388e445 into production. The previous pin
(m12-boot-pull-fix-20260821, built from 5b3cfe5 on 2026-08-21 11:35) PREDATED
the admin/data split that landed 2026-08-22 00:57, so the operator-authority
separation existed in the repo, in the manifest and in the tests while the
running binary had no such code - which is also why no admin-gate warning ever
appeared in the pod logs.
Rolled staged behind updateStrategy partition 2 -> 1 -> 0, one voter at a time,
with a quorum-acked write probe between each: HTTP 201 every time, so no write
availability was lost. PDB held disruptionsAllowed=1 / currentHealthy=3
throughout and all three voters returned lag_events=0 at term 94 afterwards.
Measured before and after on the live cluster:
POST /cluster/heal with the DATA bearer 415 -> 403
POST /cluster/members/remove with the DATA bearer 403
POST /cluster/heal with the ADMIN key 422 (past auth)
POST /sharded/items with the DATA bearer 201 -> 201 (unaffected)
POST /sharded/items with the ADMIN key 201
415 rather than 401 was the proof the gate had been OPEN: the data bearer was
authenticated and authorized for a destructive verb and only the content type
was wrong. 403 is the proof it is now shut.
ef6e0b9636