Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/longhorn/helmrelease.yaml

@@ -1,5 +1,9 @@
 ---
-# Longhorn — distributed replicated block storage (ADR-0003). Phase 0 STUB.
+# Longhorn — distributed replicated block storage across the 3 nodes (ADR-0003).
+# Serves R-STATE-01 (state survives destroy/rebuild) and R-STATE-02 (3-way replication).
+#
+# Dev-appropriate values. Environment differences enter ONLY via ${...} substitution from
+# cluster-vars (R-ENV-02); everything else is identical base config for dev and prod.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -16,21 +20,60 @@ spec:
         name: longhorn
         namespace: longhorn-system
   install:
-    createNamespace: false
+    createNamespace: false        # namespace.yaml owns it (GitOps-managed, labelled)
     remediation:
       retries: 3
   upgrade:
     remediation:
       retries: 3
   values:
-    # We define StorageClasses ourselves (storageclasses.yaml) so the default 3-replica SC and the
-    # bulk tier are explicit and GitOps-managed. Disable the chart's built-in default SC.
+    # We own the StorageClasses (storageclasses.yaml) so the default 3-replica class and the bulk
+    # tier are explicit and GitOps-managed. Disable the chart's built-in default SC so there is
+    # exactly one default-class annotation in the cluster.
     persistence:
       defaultClass: false
-      # ${LONGHORN_DEFAULT_REPLICA_COUNT} resolved from cluster-vars (R-ENV-02).
-      defaultClassReplicaCount: ${LONGHORN_DEFAULT_REPLICA_COUNT}
+
     defaultSettings:
-      # TODO(WS-STORAGE, Phase 2): set defaultDataPath to the dedicated Longhorn data disk
-      #   (docs/02 — a dedicated data disk is presented to Longhorn on each node).
+      # --- data path (R-STATE-02) ---
+      # Dedicated Longhorn data disk (/dev/vdb → ext4) is mounted here by cloud-init on every node
+      # (infra/cloud-init/user-data.yaml.tftpl). Longhorn stores replicas on this disk only.
       defaultDataPath: "/var/lib/longhorn"
-    # TODO(WS-STORAGE, Phase 4): configure off-cluster backup target here (see velero/ + ADR-0003).
+
+      # --- replication (R-STATE-02) ---
+      # Global fallback replica count. The `longhorn` StorageClass sets numberOfReplicas explicitly
+      # (authoritative); this keeps any volume created without an explicit count consistent.
+      # Substituted from cluster-vars.longhorn_default_replica_count (=3 in dev).
+      defaultReplicaCount: ${LONGHORN_DEFAULT_REPLICA_COUNT}
+
+      # --- replica anti-affinity across nodes (R-STATE-02 durability guarantee) ---
+      # HARD anti-affinity: never place two replicas of the same volume on the same node, so a
+      # single node loss cannot take down more than one replica. On a 3-node / 3-replica cluster
+      # this yields exactly one replica per node.
+      replicaSoftAntiAffinity: false
+      # Single zone (3 mini-PCs, no failure zones): allow replicas within the one zone.
+      replicaZoneSoftAntiAffinity: true
+      # When a downed node returns, rebalance replicas back toward one-per-node (best-effort so it
+      # never blocks scheduling).
+      replicaAutoBalance: "best-effort"
+
+      # --- capacity guardrails (docs/04 "reserve disk headroom") ---
+      # Reserve 20% of the dedicated data disk so a node never fills to 100% (which wedges the
+      # kubelet and Longhorn alike). Dev disks are small, so headroom matters.
+      storageReservedPercentageForDefaultDisk: "20"
+      # Stop scheduling new replicas onto a disk once free space drops below 25%.
+      storageMinimalAvailablePercentage: "25"
+      # Dev: no thin over-provisioning — requested capacity must physically fit (1:1).
+      storageOverProvisioningPercentage: "100"
+
+      # --- misc dev-appropriate defaults ---
+      # Keep replicas spread for durability rather than co-locating with the pod.
+      defaultDataLocality: "disabled"
+      # Reclaim replica space of deleted/failed volumes promptly in dev.
+      orphanAutoDeletion: true
+
+    # Longhorn's own manager/UI stay in-cluster; UI exposure (if any) is gated behind
+    # oauth2-proxy forward-auth (ADR-0014) by WS-SEC — not exposed here.
+
+    # TODO(WS-STORAGE, Phase 4): off-cluster backup target (defaultSettings.backupTarget +
+    #   backupTargetCredentialSecret) is configured alongside Velero (ADR-0003, R-STATE-03).
+    #   Credentials referenced BY NAME only, SOPS-encrypted (WS-SEC) — never inline here.