Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/monitoring/loki.yaml

@@ -1,5 +1,13 @@
 ---
-# Loki — log aggregation (docs/10). Phase 0 STUB. PVC size is an overlay knob (R-ENV-02).
+# Loki — log aggregation (docs/10). Serves R-OBS-01. PVC size is an overlay knob (R-ENV-02).
+#
+# DEV-SCOPED for the ~22 GiB ceiling. Deployment mode is SingleBinary (one pod, filesystem
+# storage) — the scalable read/write/backend split is prod-only. CRITICAL RAM TRIM: the grafana
+# loki chart's default memcached caches (chunksCache/resultsCache) request ~8-9 GiB EACH; both are
+# disabled here. The nginx `gateway`, self-monitoring, and the canary/test hooks are disabled too.
+#
+# Retention is enforced by the COMPACTOR (retention_enabled: true) — a retention_period alone does
+# nothing (docs/10, and a known-gotcha carried from the legacy stack).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -22,12 +30,63 @@ spec:
     remediation:
       retries: 3
   values:
-    # TODO(WS-OBS, Phase 4): single-binary vs scalable deployment mode; retention via compactor
-    #   (retention_enabled: true — a period alone does nothing); storage backing.
+    deploymentMode: SingleBinary
+
     loki:
+      auth_enabled: false
+      commonConfig:
+        replication_factor: 1          # single binary — no ring replication
       storage:
         type: filesystem
+      schemaConfig:
+        configs:
+          - from: "2024-04-01"
+            store: tsdb
+            object_store: filesystem
+            schema: v13
+            index:
+              prefix: loki_index_
+              period: 24h
+      limits_config:
+        # NOTE: Loki's LOG retention has no dedicated cluster-vars knob (only the 3 monitoring vars
+        # exist). Held to a dev-friendly 72h to mirror the dev metrics retention; promote to an
+        # overlay knob if per-env log retention is ever needed. See README / report.
+        retention_period: 72h
+      compactor:
+        retention_enabled: true         # REQUIRED — a period alone does not delete (docs/10)
+        delete_request_store: filesystem
+
     singleBinary:
+      replicas: 1
       persistence:
-        storageClass: longhorn
-        size: ${MONITORING_LOKI_PVC_SIZE}
+        enabled: true
+        storageClass: longhorn          # replicated tier (ADR-0003)
+        size: ${MONITORING_LOKI_PVC_SIZE}   # overlay knob (dev 5Gi / prod large)
+      resources:
+        requests:
+          cpu: 100m
+          memory: 192Mi
+        limits:
+          memory: 512Mi
+
+    # Not used in SingleBinary mode — pinned to 0 so a chart default can't spin up extra pods.
+    backend:
+      replicas: 0
+    read:
+      replicas: 0
+    write:
+      replicas: 0
+
+    # --- RAM trims: kill the memory-hungry / non-essential-for-dev pieces ---
+    chunksCache:
+      enabled: false                    # default memcached requests ~8-9Gi — must stay off in dev
+    resultsCache:
+      enabled: false
+    gateway:
+      enabled: false                    # no nginx front door needed for a single binary in-cluster
+    lokiCanary:
+      enabled: false
+    test:
+      enabled: false
+    # Alloy ships logs here (in-cluster service DNS, no gateway):
+    #   http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push