docs(pm): handoff — five WIP branches preserved after a session rate limit

Co-Authored-By: Claude Opus 5 <[email protected]>

DECISIONS-LOG.md

@@ -2997,3 +2997,48 @@ belt-and-braces rather than sole proof.
   `promtool` is being baked into the toolchain on another branch.
 - **A placeholder hardcoded in a manifest** rather than in a cluster-vars knob is out of HALF A's
   scope: it reads the ConfigMap and the overlay patches, not every YAML in the tree.
+
+---
+
+## 2026-09-13 — HANDOFF: five WIP branches, preserved after a session rate limit
+
+Five agents were terminated mid-task by an API session limit (resets 02:10 America/Chicago).
+Their uncommitted work was preserved as explicitly-labelled **WIP commits on their own branches**
+rather than left as loose files, because untracked work in a shared checkout is one stray command
+from being unrecoverable. **None is merged, none is gated. Do not merge any of them without
+finishing the listed remainder.** Each commit message states what is proven and what is missing.
+
+| branch | state | remainder |
+|---|---|---|
+| `fix/scrape-targets-for-inert-alerts` | WIP `2cd17d9` | longhorn_* and certmanager_* still ABSENT; helmrelease/values edits unverified; no conformance guard for the class; no triage of newly-firing alerts |
+| `fix/qbittorrent-durable-webui-credential` | WIP `a4ea550` | postStart hook logging (marker-file pattern, as gitea's hook does); update both arrs' stored passwords; prove survival across a pod restart |
+| `fix/postbuild-substitution-catches-dollar-mangling` | WIP `cd0112d` | prove it catches the CLASS via a scratch manifest (its fixture was reverted); answer whether a non-substituting verification path is detectable |
+| `fix/gate-does-not-pass-on-skipped-stages` | WIP `1fc6aaf` | per-stage block-vs-UNDECIDED decision; CI-vs-local detection; `ci/tests/` suite; reconcile with `fix/touched-requirements-fail-closed` |
+| `feat/close-c2-coverage-gaps` | **empty** | died before writing anything; R-C2-01/R-C2-02 remain the only 2 coverage gaps (49/51) |
+
+**Landed from that work:** the self-contained, verified half of the inert-alert audit —
+`a79693d` scrapes the six Flux controllers. Five `gotk_*` alert rules had been structurally inert
+(`count({__name__=~"gotk.*"})` returned nothing) on a repo whose entire delivery model is Flux.
+Now 39 + 117 series, and `FluxResourceSuspended` fired on a deliberate test suspension. It also
+adopted an object that existed on prod only as `kubectl-client-side-apply`.
+
+**Still inert, and this is the biggest open risk:** `longhorn_*`, `certmanager_*` and
+`hubble_drop_total` are absent, so Longhorn storage health, TLS expiry (wildcard cert due
+2026-12-12) and policy-drop alerting cannot fire at all.
+
+**Live-only state that still needs adopting:** the `qbittorrent-bootstrap` Secret exists on prod
+as `kubectl-client-side-apply` (created 05:28Z) while its SOPS file sits on the unmerged WIP
+branch. Until that merges, the credential is not reproducible from git.
+
+**The branch backlog is worse than it looks.** 30 branches are fully merged and prunable; 15 hold
+unique commits but EVERY one is a stale snapshot — merging any would delete 14k–52k lines
+(`rescued/fix/node-dns-resilient-upstream`: 380 files, −52,576). They must be cherry-picked, never
+merged. Unlanded value worth rescuing: `feat/coverage-debt-paydown` (covers exactly the 2 remaining
+gaps, plus a drafted R-TLS-02 spec amendment), `fix/touched-requirements-fail-closed` (claims
+**255 of 476 paths unmapped** in the path→requirement map — a far larger fail-open than the
+skipped-stage one; unmeasured on current main), `fix/etcd-io-priority` (I/O arbitration for the
+shared etcd/Longhorn device plus the I/O-pressure alert that missed the prod-1 outage),
+`feat/egress-gateway-staleness-alert`, and two small `rescued/*` fixes.
+
+Branch pruning was deliberately NOT done: four agent branches read as "merged, no unique commits"
+only because their agents had not committed yet, and deleting those would have destroyed live work.