Record S6 production and NAS recovery acceptance [skip ci]

specs/in_review/S6_deployment-gitea-action-to-production.md

@@ -1,6 +1,6 @@
 # S6 — Manual versioned production deployment through Gitea
 
-Status: IN_PROGRESS
+Status: IN_REVIEW
 
 Agreed after the grill-me interview; shared understanding confirmed.
 
@@ -141,44 +141,48 @@ does not restore lost data.
 
 ## Acceptance criteria
 
-- [ ] Successful main builds still automatically verify and publish matching SHA
+- [x] Successful main builds still automatically verify and publish matching SHA
       images; publishing does not automatically change production.
-- [ ] Gitea's manual workflow form provides new/retry mode and the appropriate
+- [x] Gitea's manual workflow form provides new/retry mode and the appropriate
       release-type or existing-tag inputs; invalid combinations fail clearly.
-- [ ] The first release and subsequent patch/minor/major releases allocate the
+- [x] The first release and subsequent patch/minor/major releases allocate the
       agreed versions and immutable annotated remote Git tags on verified SHAs.
-- [ ] Duplicate new releases, tag conflicts, concurrent attempts, stale main
+- [x] Duplicate new releases, tag conflicts, concurrent attempts, stale main
       snapshots and older pending deployments cannot overwrite release identity
       or replace a newer successful release.
-- [ ] An unverified release or missing image is rejected before production changes;
+- [x] An unverified release or missing image is rejected before production changes;
       branch builds cannot deploy production.
-- [ ] A real Synology deployment serves the frontend and proxied API over the
+- [x] A real Synology deployment serves the frontend and proxied API over the
       private endpoint, with both containers running the selected image pair.
-- [ ] Readiness, frontend, proxied read-only API and image-identity checks establish
+- [x] Readiness, frontend, proxied read-only API and image-identity checks establish
       success within five minutes or trigger recovery.
-- [ ] A deliberately failed release restores the previous successful version,
+- [x] A deliberately failed release restores the previous successful version,
       while the workflow reports failure. Failed first deployment and failed
       recovery produce actionable diagnostics and manual recovery instructions.
-- [ ] A failed release can be retried with its existing tag/SHA without allocating
+- [x] A failed release can be retried with its existing tag/SHA without allocating
       another version or superseding a newer successful release.
-- [ ] Manual rollback demonstrably restores the previous successful release with
+- [x] Manual rollback demonstrably restores the previous successful release with
       no new version, and required retained images are available.
-- [ ] The temporary pre-S16 data-loss policy is visible in workflow documentation
+- [x] The temporary pre-S16 data-loss policy is visible in workflow documentation
       and the runbook. Once S16 applies, demonstrate saved data surviving both
       deployment and rollback, including the migration compatibility requirement.
-- [ ] Server setup and operational recovery documentation are usable; diagnostics
+      The latter is conditional S16 acceptance and is not applicable yet.
+- [x] Server setup and operational recovery documentation are usable; diagnostics
       and release outcomes are retained for fourteen days without secrets.
 
-## Implementation handoff
+## Implementation and evidence
 
-This specification records the confirmed design. Implementing workflows, release
-automation, Compose configuration, Synology provisioning and collecting actual
-deployment/recovery evidence are subsequent work. Configuration alone does not
+This specification records the confirmed design. The evidence combines automated
+behavior tests, real Gitea production release/guard runs and isolated real NAS
+fault tests. Their distinct scopes and the virtual-tag boundary of the isolated
+tests are documented in `docs/s6-validation.md`. Configuration alone does not
 complete S6.
 
-Implementation is in progress on `feature/S6_deployment`: workflows, Compose,
-release/retry/rollback helpers, failure-path tests and provisioning/runbook are
-provided. The dedicated NAS account, registry login and Gitea deployment secrets
-are provisioned. Real image preparation passed without a release or container
-replacement. See `docs/s6-validation.md`; workflow execution and production
-deployment/recovery evidence remain required after the protected main merge.
+Implementation PR #12 is merged. Production `v1.0.0` runs at
+`http://192.168.2.28:8088` following a successful main build and real manual Gitea
+deployment. Native duplicate/branch guards and downloadable artifacts were
+verified. Twelve isolated real NAS checks cover recovery, retry, distinct-version
+rollback, failure guards and manual recovery; they use separate state/containers
+and virtual test tags, without changing production. The test resources have been
+removed. See `docs/s6-validation.md` for run links, digests, evidence boundaries
+and the conditional S16 data-persistence acceptance. S6 is ready for review.