feat(github-runner): harden Linux runner fleet

2026-05-17 21:50:29 -05:00
56 changed files with 200 additions and 7562 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +0,0 @@
-/.gitattributes text eol=lf
-*.yaml text eol=lf
-*.yml text eol=lf
-*.sh text eol=lf
--- a/README.md
+++ b/README.md
@@ -116,19 +116,8 @@ dotnet test tests/bluejay-infra-lint/BluejayInfraLint.Tests.csproj -c Release

 That test project sweeps `bluejay-infra/apps/**` plus the canonical sibling `FlowerCore.*\\k8s` manifests that share the same workspace. Matching `conftest.dev` policy files live under `tests/bluejay-infra-lint/conftest.dev/` for environments that also have `conftest` or `opa`.

-## Non-K8s Pi Artifacts
-
-Some `apps/*` directories are deployment artifact bundles consumed by Puppet
-instead of Kubernetes workloads. `apps/fc-signage-pi-player/` carries the
-Chromium signage Pi player, `apps/fc-divoom-dm-pi-device/` carries the additive
-edge2 Divoom-as-DeviceManagement-device profile/Hiera contract, and
-`apps/fc-divoom-tv-pi/` carries the Divoom TV Pi HDMI systemd/Puppet shape.
-These bundles intentionally avoid Deployment, IngressRoute, Certificate, and
-OnePasswordItem resources.
-
 ## References

- OpenVox noc1 durability runbook: `docs/runbooks/openvoxserver-quadlet-durability.md`
 - Cert-manager recovery playbook: `FlowerCore.Notes/memory/project_cert_manager_recovery_2026_04_22.md`
 - Why pfSense DNS is required: `FlowerCore.Notes/memory/feedback_pfsense_dns_required_for_acme.md`
 - Public DNS operator host: `https://dns.iamworkin.lan`
--- a/apps/authentik/authentik.yaml
+++ b/apps/authentik/authentik.yaml
@@ -1,448 +0,0 @@
-# Authentik OIDC backend
-# ArgoCD-managed. BlueJay Lab.
-#
-# Stack:
-#   - PostgreSQL 16 StatefulSet (single replica, Longhorn RWO 5Gi)
-#   - Redis 7 Deployment (no persistence — session/cache only)
-#   - Authentik server + worker Deployments (image ghcr.io/goauthentik/server:2024.12.3)
-#   - Media PVC shared between server + worker (Longhorn RWO 2Gi)
-#   - Certificate via step-ca-acme ClusterIssuer
-#   - Traefik IngressRoute at id.iamworkin.lan
-#
-# Secrets come from 1Password item "authentik-credentials" (IAmWorkin vault, id y6i74ch22q5wvm7znquq4nhhcu)
-# via the OnePasswordItem CRD, materialized into k8s Secret authentik/authentik-credentials.
-#
-# Why the discovery URL is /application/o/pimanager/ : Authentik issues per-application OIDC providers.
-# The pimanager OIDC application/provider is created after the cluster pods are healthy (manual or
-# via API once the bootstrap token is available — see Notes substrate).
-
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authentik
-  labels:
-    app.kubernetes.io/part-of: bluejay-infra
-
---
-# 1Password operator pulls the authentik-credentials item into a k8s Secret of the same name.
-# Field labels in 1P become Secret keys: AUTHENTIK_SECRET_KEY, POSTGRES_PASSWORD, REDIS_PASSWORD,
-# BOOTSTRAP_ADMIN_PASSWORD, BOOTSTRAP_ADMIN_TOKEN, BOOTSTRAP_ADMIN_EMAIL.
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: authentik-credentials
-  namespace: authentik
-spec:
-  itemPath: "vaults/IAmWorkin/items/authentik-credentials"
-
---
-# Shared media volume for server + worker pods.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: authentik-media
-  namespace: authentik
-spec:
-  storageClassName: longhorn
-  accessModes: [ReadWriteOnce]
-  resources:
-    requests:
-      storage: 2Gi
-
---
-# PostgreSQL 16 StatefulSet — Authentik's primary store.
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: authentik-postgres
-  namespace: authentik
-  labels:
-    app: authentik-postgres
-    argocd.argoproj.io/instance: infra-authentik
-spec:
-  persistentVolumeClaimRetentionPolicy:
-    whenDeleted: Retain
-    whenScaled: Retain
-  podManagementPolicy: OrderedReady
-  serviceName: authentik-postgres
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: authentik-postgres
-  template:
-    metadata:
-      labels:
-        app: authentik-postgres
-    spec:
-      containers:
-        - name: postgres
-          image: postgres:16-alpine
-          ports:
-            - containerPort: 5432
-              name: postgres
-          env:
-            - name: POSTGRES_USER
-              value: authentik
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: POSTGRES_PASSWORD
-            - name: POSTGRES_DB
-              value: authentik
-            - name: POSTGRES_INITDB_ARGS
-              value: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-          readinessProbe:
-            exec:
-              command: ["pg_isready", "-U", "authentik"]
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          livenessProbe:
-            exec:
-              command: ["pg_isready", "-U", "authentik"]
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          resources:
-            requests: { cpu: 100m, memory: 256Mi }
-            limits: { cpu: 1000m, memory: 1Gi }
-          volumeMounts:
-            - name: pgdata
-              mountPath: /var/lib/postgresql/data
-  volumeClaimTemplates:
-    - metadata:
-        name: pgdata
-      spec:
-        storageClassName: longhorn
-        accessModes: [ReadWriteOnce]
-        volumeMode: Filesystem
-        resources:
-          requests:
-            storage: 5Gi
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-postgres
-  namespace: authentik
-spec:
-  clusterIP: None
-  selector:
-    app: authentik-postgres
-  ports:
-    - name: postgres
-      port: 5432
-      targetPort: 5432
-
---
-# Redis 7 — session storage + Celery broker. No persistence needed (cache).
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-redis
-  namespace: authentik
-  labels:
-    app: authentik-redis
-    argocd.argoproj.io/instance: infra-authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: authentik-redis
-  template:
-    metadata:
-      labels:
-        app: authentik-redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          args:
-            - "--save"
-            - ""
-            - "--appendonly"
-            - "no"
-            - "--requirepass"
-            - "$(REDIS_PASSWORD)"
-          env:
-            - name: REDIS_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: REDIS_PASSWORD
-          ports:
-            - containerPort: 6379
-              name: redis
-          readinessProbe:
-            tcpSocket: { port: 6379 }
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          livenessProbe:
-            tcpSocket: { port: 6379 }
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          resources:
-            requests: { cpu: 50m, memory: 64Mi }
-            limits: { cpu: 500m, memory: 256Mi }
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-redis
-  namespace: authentik
-spec:
-  selector:
-    app: authentik-redis
-  ports:
-    - name: redis
-      port: 6379
-      targetPort: 6379
-
---
-# Authentik server Deployment — HTTP frontend on :9000.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-server
-  namespace: authentik
-  labels:
-    app: authentik-server
-    argocd.argoproj.io/instance: infra-authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate  # shares /media RWO PVC with worker
-  selector:
-    matchLabels:
-      app: authentik-server
-  template:
-    metadata:
-      labels:
-        app: authentik-server
-    spec:
-      securityContext:
-        # Authentik image runs as uid 1000 "authentik" but the Longhorn PVC mounts
-        # root:root by default. fsGroup recursively chgrp + chmod g+rwx so the
-        # non-root container can mkdir /media/public during the tenant_files migration.
-        fsGroup: 1000
-      containers:
-        - name: server
-          image: ghcr.io/goauthentik/server:2024.12.3
-          args: ["server"]
-          ports:
-            - containerPort: 9000
-              name: http
-            - containerPort: 9443
-              name: https
-          env:
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_REDIS__HOST
-              value: authentik-redis
-            - name: AUTHENTIK_REDIS__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: REDIS_PASSWORD
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              value: authentik-postgres
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__USER
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: POSTGRES_PASSWORD
-            - name: AUTHENTIK_BOOTSTRAP_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: BOOTSTRAP_ADMIN_PASSWORD
-            - name: AUTHENTIK_BOOTSTRAP_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: BOOTSTRAP_ADMIN_TOKEN
-            - name: AUTHENTIK_BOOTSTRAP_EMAIL
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: BOOTSTRAP_ADMIN_EMAIL
-            - name: AUTHENTIK_DISABLE_UPDATE_CHECK
-              value: "true"
-            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
-              value: "false"
-            - name: AUTHENTIK_LOG_LEVEL
-              value: info
-          # First-boot Authentik can take 3+ min on the migration phase
-          # (waiting on DB lock while worker also runs migrations). Initial
-          # delays are generous so kubelet doesn't kill the pod mid-migration;
-          # periodSeconds keeps post-startup probing responsive.
-          readinessProbe:
-            httpGet:
-              path: /-/health/ready/
-              port: 9000
-            initialDelaySeconds: 60
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 12
-          livenessProbe:
-            httpGet:
-              path: /-/health/live/
-              port: 9000
-            initialDelaySeconds: 300
-            periodSeconds: 30
-            timeoutSeconds: 10
-            failureThreshold: 3
-          startupProbe:
-            httpGet:
-              path: /-/health/live/
-              port: 9000
-            initialDelaySeconds: 30
-            periodSeconds: 15
-            timeoutSeconds: 10
-            failureThreshold: 40  # 30s + 40*15s = 10.5 min budget
-          resources:
-            requests: { cpu: 150m, memory: 512Mi }
-            limits: { cpu: 1500m, memory: 1Gi }
-          volumeMounts:
-            - name: media
-              mountPath: /media
-      volumes:
-        - name: media
-          persistentVolumeClaim:
-            claimName: authentik-media
-
---
-# Authentik worker Deployment — runs Celery background tasks.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-worker
-  namespace: authentik
-  labels:
-    app: authentik-worker
-    argocd.argoproj.io/instance: infra-authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate  # shares /media RWO PVC with server
-  selector:
-    matchLabels:
-      app: authentik-worker
-  template:
-    metadata:
-      labels:
-        app: authentik-worker
-    spec:
-      securityContext:
-        # Same as server pod — non-root uid 1000 needs PVC group write.
-        fsGroup: 1000
-      containers:
-        - name: worker
-          image: ghcr.io/goauthentik/server:2024.12.3
-          args: ["worker"]
-          env:
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_REDIS__HOST
-              value: authentik-redis
-            - name: AUTHENTIK_REDIS__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: REDIS_PASSWORD
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              value: authentik-postgres
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__USER
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-credentials
-                  key: POSTGRES_PASSWORD
-            - name: AUTHENTIK_DISABLE_UPDATE_CHECK
-              value: "true"
-            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
-              value: "false"
-            - name: AUTHENTIK_LOG_LEVEL
-              value: info
-          resources:
-            requests: { cpu: 100m, memory: 256Mi }
-            limits: { cpu: 1000m, memory: 768Mi }
-          volumeMounts:
-            - name: media
-              mountPath: /media
-      volumes:
-        - name: media
-          persistentVolumeClaim:
-            claimName: authentik-media
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-server
-  namespace: authentik
-spec:
-  selector:
-    app: authentik-server
-  ports:
-    - name: http
-      port: 9000
-      targetPort: 9000
-    - name: https
-      port: 9443
-      targetPort: 9443
-
---
-# step-ca leaf certificate for id.iamworkin.lan.
-# step-ca container resolver uses pfSense Unbound, so the public A record for id.iamworkin.lan
-# MUST exist before this Certificate is applied (cert-manager HTTP-01 will silently 2h-backoff
-# otherwise). Added 2026-05-25 via scripts/pfsense-add-id-host.py.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: authentik-tls
-  namespace: authentik
-spec:
-  secretName: authentik-tls
-  dnsNames:
-    - id.iamworkin.lan
-  issuerRef:
-    name: step-ca-acme
-    kind: ClusterIssuer
-
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: authentik
-  namespace: authentik
-spec:
-  entryPoints: [websecure]
-  routes:
-    - match: Host(`id.iamworkin.lan`)
-      kind: Rule
-      services:
-        - name: authentik-server
-          port: 9000
-  tls:
-    secretName: authentik-tls
--- a/apps/fc-aistation/fc-aistation.yaml
+++ b/apps/fc-aistation/fc-aistation.yaml
@@ -1,169 +0,0 @@
-# FlowerCore.AiStation.Web GitOps adoption manifest.
-#
-# Authored from the already-live fc-aistation resources on 2026-06-04.
-# Keep the live image tag, Service ClusterIP, and PVC volumeName unchanged so
-# ArgoCD adopts in place instead of replacing the workload or data volume.
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: aistation-web-data
-  namespace: fc-aistation
-  labels:
-    app.kubernetes.io/name: aistation-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-aistation
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
-  volumeMode: Filesystem
-  volumeName: pvc-27448d6f-6e66-42a7-a293-73dd8bbd6b3e
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: aistation-web
-  namespace: fc-aistation
-  labels:
-    app.kubernetes.io/name: aistation-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-aistation
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: aistation-web
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        prometheus.io/path: /metrics/prometheus
-        prometheus.io/port: "5000"
-        prometheus.io/scrape: "true"
-      labels:
-        app.kubernetes.io/name: aistation-web
-        app.kubernetes.io/part-of: flowercore
-    spec:
-      containers:
-        - envFrom:
-            - configMapRef:
-                name: aistation-web-config
-          image: localhost/fc-aistation-web:v20260602-aistation-owned-deploy-fix2
-          imagePullPolicy: Never
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 5000
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          name: aistation-web
-          ports:
-            - containerPort: 5000
-              name: http
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 6
-            httpGet:
-              path: /healthz
-              port: 5000
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources: {}
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: aistation-web-data
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: aistation-web
-  namespace: fc-aistation
-  labels:
-    app.kubernetes.io/name: aistation-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-aistation
-spec:
-  clusterIP: 10.43.211.127
-  clusterIPs:
-    - 10.43.211.127
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-    - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: 5000
-  selector:
-    app.kubernetes.io/name: aistation-web
-  sessionAffinity: None
-  type: ClusterIP
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: aistation-web-tls
-  namespace: fc-aistation
-  labels:
-    app.kubernetes.io/name: aistation-web-tls
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-aistation
-spec:
-  dnsNames:
-    - aistation.iamworkin.lan
-  issuerRef:
-    kind: ClusterIssuer
-    name: step-ca-acme
-  secretName: aistation-web-tls
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: aistation-web
-  namespace: fc-aistation
-  labels:
-    app.kubernetes.io/name: aistation-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-aistation
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - kind: Rule
-      match: Host(`aistation.iamworkin.lan`)
-      services:
-        - name: aistation-web
-          port: 80
-  tls:
-    secretName: aistation-web-tls
--- a/apps/fc-chat/fc-chat.yaml
+++ b/apps/fc-chat/fc-chat.yaml
@@ -1,206 +1,5 @@
-# FlowerCore Chat
-#
-# ArgoCD-managed workload plus TLS/Ingress. The chat-web-secret remains an
-# out-of-band Secret until the values are moved into a 1Password-backed item;
-# the Deployment references it as optional so GitOps can own the workload
-# without storing secret material in this repo.
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: fc-chat
-  labels:
-    app.kubernetes.io/part-of: flowercore
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: chat-web-config
-  namespace: fc-chat
-  labels:
-    app.kubernetes.io/name: chat-web
-    app.kubernetes.io/part-of: flowercore
-data:
-  ASPNETCORE_ENVIRONMENT: Production
-  ASPNETCORE_URLS: "http://+:8080"
-  ASPNETCORE_FORWARDEDHEADERS_ENABLED: "true"
-  FlowerCore__Auth__Enabled: "false"
-  FlowerCore__Auth__Oidc__Enabled: "true"
-  FlowerCore__Auth__Oidc__Authority: "https://id.iamworkin.lan/application/o/chat/"
-  FlowerCore__Auth__Oidc__Audience: "chat"
-  FlowerCore__Auth__Oidc__ClientId: "chat"
-  FlowerCore__Database__ConnectionStrings__Sqlite: "Data Source=/data/chat.db"
-  # Ollama target. Switched 2026-04-25 from edge1 Pi5 (10.0.57.17) to BLUEJAY-WS
-  # workstation (10.0.56.20, RX 9070 XT 16GB, OLLAMA_HOST=0.0.0.0:11434, Vulkan
-  # backend per feedback_rdna4_vulkan_broken). The Pi5 was timing out every team-
-  # round speaker at the 300s per-turn cap (live-proven 2026-04-25 03:53 UTC,
-  # see feedback_chat_team_round_edge1_too_slow). Workstation has gemma3:4b for
-  # the Cheap tier, plus gemma3:27b/phi4:14b/qwen3:14b for Default/Balanced/Deep.
-  # Piper TTS stays on edge1 below (different service, Pi handles TTS fine).
-  FlowerCore__AI__OllamaBaseUrl: "http://10.0.56.20:11434"
-  FlowerCore__AI__DefaultModelName: "phi4:14b"
-  ChatOptions__BehaviorRuleEngine__OllamaBaseUrl: "http://10.0.56.20:11434"
-  ChatOptions__BehaviorRuleEngine__FallbackOllamaBaseUrl: "http://10.0.57.17:11434"
-  ChatOptions__BehaviorRuleEngine__ModelName: "gemma3:12b"
-  FlowerCore__AI__Memory__UseSharedIndexingAdapter: "true"
-  FlowerCore__AI__Memory__UseOllamaEmbeddings: "true"
-  FlowerCore__AI__Memory__EmbeddingModel: "nomic-embed-text"
-  FlowerCore__AI__Memory__EnableSharedIndexingBackfill: "true"
-  FlowerCore__AI__Memory__SharedIndexingDatabasePath: "/data/chat-memory-index.db"
-  FlowerCore__AI__Skills__Library__LibraryApiUrl: "http://library-web.fc-library.svc.cluster.local"
-  FlowerCore__AI__Skills__Retail__RetailApiUrl: "http://retail-web.fc-retail.svc.cluster.local"
-  FlowerCore__AI__Skills__Intranet__IntranetBaseUrl: "http://intranet-web.intranet.svc.cluster.local"
-  FlowerCore__AI__Skills__Print__PrintMcpBaseUrl: "http://10.0.57.16:5200"
-  FlowerCore__AI__IrcBridge__Enabled: "true"
-  FlowerCore__AI__IrcBridge__DefaultProfileSlug: "it-helpdesk"
-  FlowerCore__AI__IrcBridge__MentionProfileSlug: "it-helpdesk"
-  FlowerCore__AI__IrcBridge__MentionReactiveMode: "mentions-only"
-  FlowerCore__AI__IrcBridge__AllowActionExecution: "false"
-  FlowerCore__AI__Voice__Piper__Host: "10.0.57.17"
-  FlowerCore__AI__Voice__Piper__Port: "10400"
-  FlowerCore__AI__Voice__OutputRoot: "/data/audio"
-  FlowerCore__AI__Voice__RetentionDays: "30"
-  # LLM provider abstraction (ADR-088). Anthropic stays disabled here -- when
-  # an operator wants to enable Claude, they flip Enabled=true and mount
-  # FlowerCore__Anthropic__ApiKey from the onepassword-synced Secret (see
-  # docs/ai-agents/anthropic-integration.md).
-  FlowerCore__Anthropic__Enabled: "false"
-  FlowerCore__Anthropic__BaseUrl: "https://api.anthropic.com"
-  FlowerCore__Anthropic__DefaultModel: "claude-sonnet-4-6"
-  FlowerCore__Anthropic__CheapModel: "claude-haiku-4-5-20251001"
-  FlowerCore__Anthropic__DeepModel: "claude-opus-4-7"
-  FlowerCore__Budget__ResponseCacheEnabled: "true"
-  OTEL_SERVICE_NAME: FlowerCore.Chat
-  OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-collector.monitoring.svc.cluster.local:4317"
-  OTEL_EXPORTER_OTLP_PROTOCOL: grpc
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: chat-web-data
-  namespace: fc-chat
-  labels:
-    app.kubernetes.io/name: chat-web
-    app.kubernetes.io/part-of: flowercore
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: chat-web
-  namespace: fc-chat
-  labels:
-    app.kubernetes.io/name: chat-web
-    app.kubernetes.io/part-of: flowercore
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: chat-web
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: chat-web
-        app.kubernetes.io/part-of: flowercore
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics/prometheus"
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: rke2-server
-      securityContext:
-        fsGroup: 1654
-        fsGroupChangePolicy: OnRootMismatch
-      containers:
-        - name: chat-web
-          image: localhost/fc-chat-web:v20260603-oidc-authentik
-          imagePullPolicy: Never
-          ports:
-            - name: http
-              containerPort: 8080
-          envFrom:
-            - configMapRef:
-                name: chat-web-config
-            - secretRef:
-                name: chat-web-secret
-                optional: true
-          env:
-            - name: FlowerCore__Auth__Oidc__Authority
-              valueFrom:
-                secretKeyRef:
-                  name: chat-oidc-client
-                  key: issuer_url
-                  optional: true
-            - name: FlowerCore__Auth__Oidc__ClientId
-              valueFrom:
-                secretKeyRef:
-                  name: chat-oidc-client
-                  key: client_id
-                  optional: true
-            - name: FlowerCore__Auth__Oidc__ClientSecret
-              valueFrom:
-                secretKeyRef:
-                  name: chat-oidc-client
-                  key: client_secret
-                  optional: true
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: 8080
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 6
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8080
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: chat-web-data
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: chat-web
-  namespace: fc-chat
-  labels:
-    app.kubernetes.io/name: chat-web
-    app.kubernetes.io/part-of: flowercore
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: chat-web
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP
+# FlowerCore Chat — TLS + Ingress
+# Deployment and Service managed by deploy script (not ArgoCD)
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -231,41 +30,3 @@ spec:
          port: 80
  tls:
    secretName: chat-web-tls
---
-# Public host profile marker. The app treats this header as authoritative for
-# the public twin, while the internal chat.iamworkin.lan route does not attach
-# it and keeps the operator-oriented UI.
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: chat-public-profile-header
-  namespace: fc-chat
-spec:
-  headers:
-    customRequestHeaders:
-      X-FC-Chat-Host-Profile: "public"
---
-# Public Cloudflare-fronted twin for the anonymous chat surface. Operator
-# paths are intentionally absent from the allowlist below, so /admin,
-# /operator, /console, /ops, /api/operator, and /operatorhub miss this route
-# and return Traefik 404 before reaching the pod. Operator action still needed:
-# create/verify Cloudflare DNS chat.flowercore.io -> public Traefik endpoint
-# and mirror the cf-origin-flowercore-io TLS secret into namespace fc-chat.
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: chat-web-public
-  namespace: fc-chat
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`chat.flowercore.io`) && (Path(`/`) || Path(`/chat`) || PathPrefix(`/_blazor`) || PathPrefix(`/_framework`) || PathPrefix(`/_content`) || PathPrefix(`/avatars`) || PathPrefix(`/css`) || PathPrefix(`/js`) || PathPrefix(`/favicon`) || PathPrefix(`/chathub`)) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
-      kind: Rule
-      middlewares:
-        - name: chat-public-profile-header
-      services:
-        - name: chat-web
-          port: 80
-  tls:
-    secretName: cf-origin-flowercore-io
--- a/apps/fc-devicemgmt/1password-item.yaml
+++ b/apps/fc-devicemgmt/1password-item.yaml
@@ -1,26 +0,0 @@
-# Runtime secrets for FlowerCore.DeviceManagement.
-#
-# OnePasswordItem operator syncs this item into a Kubernetes Secret with the
-# same name. Expected fields:
-#   DB-Password
-#   mtls-ca.pem
-#   mtls-client.crt
-#   mtls-client.key
-#   mtls-chain.pem
-#
-# Do not add literal secret values to this repo. Runtime pods consume the
-# synced Secret through env vars and read-only mounts.
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: fc-devicemgmt-runtime
-  namespace: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt
-    app.kubernetes.io/component: secrets
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-spec:
-  itemPath: "vaults/IAmWorkin/items/FlowerCore DeviceManagement Runtime"
--- a/apps/fc-devicemgmt/certificate-web.yaml
+++ b/apps/fc-devicemgmt/certificate-web.yaml
@@ -1,30 +0,0 @@
-# Certificate for devices.iamworkin.lan.
-#
-# Preflight gate: FlowerCore.DNS / pfSense must contain an explicit A record:
-#   devices.iamworkin.lan -> 10.0.56.200
-# before this Certificate is synced. step-ca ACME cannot see the CoreDNS
-# wildcard, so missing pfSense DNS produces cert-manager HTTP-01 backoff
-# (feedback_pfsense_dns_required_for_acme).
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: fc-devicemgmt-web-tls
-  namespace: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-web
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-  annotations:
-    flowercore.io/dns-preflight: "devices.iamworkin.lan must resolve to 10.0.56.200 before ACME sync"
-spec:
-  secretName: fc-devicemgmt-web-tls
-  issuerRef:
-    name: step-ca-acme
-    kind: ClusterIssuer
-  dnsNames:
-    - devices.iamworkin.lan
-  duration: 720h
-  renewBefore: 240h
--- a/apps/fc-devicemgmt/clusterrole-operator.yaml
+++ b/apps/fc-devicemgmt/clusterrole-operator.yaml
@@ -1,81 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: fc-devicemgmt-operator
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-operator
-    app.kubernetes.io/component: operator
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-rules:
-  - apiGroups:
-      - devices.flowercore.io
-    resources:
-      - '*'
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - devices.flowercore.io
-    resources:
-      - devices/status
-      - devices/finalizers
-      - devicegroups/status
-      - devicegroups/finalizers
-      - devicepolicies/status
-      - devicepolicies/finalizers
-      - remotecommands/status
-      - remotecommands/finalizers
-    verbs:
-      - get
-      - update
-      - patch
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - configmaps
-      - secrets
-      - events
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - batch
-    resources:
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - networkpolicies
-    verbs:
-      - get
-      - list
-      - watch
--- a/apps/fc-devicemgmt/clusterrolebinding-operator.yaml
+++ b/apps/fc-devicemgmt/clusterrolebinding-operator.yaml
@@ -1,19 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: fc-devicemgmt-operator
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-operator
-    app.kubernetes.io/component: operator
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: fc-devicemgmt-operator
-subjects:
-  - kind: ServiceAccount
-    name: fc-devicemgmt-operator
-    namespace: fc-devicemgmt
--- a/apps/fc-devicemgmt/deployment-operator.yaml
+++ b/apps/fc-devicemgmt/deployment-operator.yaml
@@ -1,109 +0,0 @@
-# FlowerCore.DeviceManagement Operator.
-#
-# KubeOps controller for devices.flowercore.io resources. Operator-created
-# children must set OwnerReferences + traceability labels/annotations per
-# k8s-pod-ownership-and-traceability-standard.md. RBAC below grants
-# apps/deployments/get so the process can resolve its own Deployment UID.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: fc-devicemgmt-operator
-  namespace: fc-devicemgmt
-  labels:
-    app: fc-devicemgmt-operator
-    app.kubernetes.io/name: fc-devicemgmt-operator
-    app.kubernetes.io/component: operator
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-  annotations:
-    flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app: fc-devicemgmt-operator
-  template:
-    metadata:
-      labels:
-        app: fc-devicemgmt-operator
-        app.kubernetes.io/name: fc-devicemgmt-operator
-        app.kubernetes.io/component: operator
-        app.kubernetes.io/part-of: flowercore
-        app.kubernetes.io/managed-by: argocd
-        flowercore.io/tenant-id: system
-        flowercore.io/created-by: bluejay-infra
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-        flowercore.io/audit-trace-id: "runtime-activity-trace"
-    spec:
-      serviceAccountName: fc-devicemgmt-operator
-      securityContext:
-        fsGroup: 1654
-        fsGroupChangePolicy: OnRootMismatch
-      containers:
-        - name: operator
-          image: localhost/fc-devicemgmt-operator:v20260519-sp34cl3-fix
-          imagePullPolicy: Never
-          ports:
-            - name: metrics
-              containerPort: 8080
-          env:
-            - name: ASPNETCORE_ENVIRONMENT
-              value: "Production"
-            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
-              value: "false"
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: FLOWERCORE_KUBERNETES_OWNER_DEPLOYMENT
-              value: "fc-devicemgmt-operator"
-            - name: FlowerCore__Service__Name
-              value: "FlowerCore.DeviceManagement.Operator"
-            - name: FlowerCore__DeviceManagement__DefaultTenantId
-              value: "system"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
-          readinessProbe:
-            tcpSocket:
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              port: 8080
-            initialDelaySeconds: 20
-            periodSeconds: 30
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1654
-            runAsGroup: 1654
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-            - name: logs
-              mountPath: /app/logs
-      volumes:
-        - name: tmp
-          emptyDir: {}
-        - name: logs
-          emptyDir: {}
--- a/apps/fc-devicemgmt/deployment-web.yaml
+++ b/apps/fc-devicemgmt/deployment-web.yaml
@@ -1,151 +0,0 @@
-# FlowerCore.DeviceManagement Web.
-#
-# Source repo is expected to ship FlowerCore.DeviceManagement.Web in a later
-# Sprint 9+ lane. This manifest is static-valid without requiring the image to
-# exist yet; import localhost/fc-devicemgmt-web:<tag> to all schedulable RKE2
-# nodes before letting ArgoCD sync a live rollout.
-#
-# SCALED TO 0 — 2026-05-19 morning-routine cleanup.
-# The Web pod cannot start until TWO upstream gaps close:
-#   1. MySQL DB instance `flowercore_devicemgmt` (user `fc_devicemgmt`) is
-#      provisioned via fc-mysql Manager. The cluster currently has ZERO
-#      MySqlInstanceCrds and no `mysql.fc-mysql.svc:3306` Service, so the
-#      deployment-web container env `FlowerCore__Database__Host=mysql.fc-mysql.svc`
-#      points at nothing. Provision via the fc-mysql Manager UI/REST/MCP.
-#   2. 1Password vault item `IAmWorkin/FlowerCore DeviceManagement Runtime`
-#      with 5 fields (DB-Password, mtls-ca.pem, mtls-client.crt, mtls-client.key,
-#      mtls-chain.pem) — see apps/fc-devicemgmt/1password-item.yaml. Mint mTLS
-#      from step-ca-agent ClusterIssuer per ADR-126; DB-Password must match the
-#      password configured for the MySQL user.
-# Re-enable: change replicas back to 2 after both gaps close. The image tag
-# in this file (v20260512-cx5) MAY also need a refresh — it predates the
-# Sprint 34 Cl-3 operator fix; Web may have an analogous bug.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: fc-devicemgmt-web
-  namespace: fc-devicemgmt
-  labels:
-    app: fc-devicemgmt-web
-    app.kubernetes.io/name: fc-devicemgmt-web
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-  annotations:
-    flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
-spec:
-  replicas: 0
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app: fc-devicemgmt-web
-  template:
-    metadata:
-      labels:
-        app: fc-devicemgmt-web
-        app.kubernetes.io/name: fc-devicemgmt-web
-        app.kubernetes.io/component: web
-        app.kubernetes.io/part-of: flowercore
-        app.kubernetes.io/managed-by: argocd
-        flowercore.io/tenant-id: system
-        flowercore.io/created-by: bluejay-infra
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-        flowercore.io/audit-trace-id: "runtime-activity-trace"
-    spec:
-      securityContext:
-        fsGroup: 1654
-        fsGroupChangePolicy: OnRootMismatch
-      containers:
-        - name: web
-          image: localhost/fc-devicemgmt-web:v20260512-cx5
-          imagePullPolicy: Never
-          ports:
-            - name: http
-              containerPort: 8080
-          env:
-            - name: ASPNETCORE_URLS
-              value: "http://+:8080"
-            - name: ASPNETCORE_ENVIRONMENT
-              value: "Production"
-            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
-              value: "false"
-            - name: FlowerCore__Service__Name
-              value: "FlowerCore.DeviceManagement.Web"
-            - name: FlowerCore__DeviceManagement__DefaultTenantId
-              value: "system"
-            - name: FlowerCore__Database__Provider
-              value: "MySql"
-            - name: FlowerCore__Database__Host
-              value: "mysql.fc-mysql.svc"
-            - name: FlowerCore__Database__Database
-              value: "flowercore_devicemgmt"
-            - name: FlowerCore__Database__User
-              value: "fc_devicemgmt"
-            - name: FlowerCore__Database__Password
-              valueFrom:
-                secretKeyRef:
-                  name: fc-devicemgmt-runtime
-                  key: DB-Password
-            - name: FlowerCore__DeviceManagement__AgentMtls__CaPath
-              value: "/secrets/devicemgmt-mtls/mtls-ca.pem"
-            - name: FlowerCore__DeviceManagement__AgentMtls__ClientCertificatePath
-              value: "/secrets/devicemgmt-mtls/mtls-client.crt"
-            - name: FlowerCore__DeviceManagement__AgentMtls__ClientKeyPath
-              value: "/secrets/devicemgmt-mtls/mtls-client.key"
-            - name: FlowerCore__EventBus__Redis__Configuration
-              value: "redis.fc-redis.svc:6379"
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 1000m
-              memory: 768Mi
-          startupProbe:
-            tcpSocket:
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            failureThreshold: 30
-          readinessProbe:
-            tcpSocket:
-              port: 8080
-            periodSeconds: 10
-            failureThreshold: 3
-          livenessProbe:
-            tcpSocket:
-              port: 8080
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            failureThreshold: 3
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1654
-            runAsGroup: 1654
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-            - name: logs
-              mountPath: /app/logs
-            - name: devicemgmt-mtls
-              mountPath: /secrets/devicemgmt-mtls
-              readOnly: true
-      volumes:
-        - name: tmp
-          emptyDir: {}
-        - name: logs
-          emptyDir: {}
-        - name: devicemgmt-mtls
-          secret:
-            secretName: fc-devicemgmt-runtime
-            defaultMode: 0400
--- a/apps/fc-devicemgmt/ingressroute-web.yaml
+++ b/apps/fc-devicemgmt/ingressroute-web.yaml
@@ -1,55 +0,0 @@
-# LAN ingress for FlowerCore.DeviceManagement Web.
-#
-# RKE2 Traefik has no built-in ACME resolver configured. Keep TLS certificate
-# ownership in cert-manager Certificate/fc-devicemgmt-web-tls.
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: fc-devicemgmt-web
-  namespace: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-web
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`devices.iamworkin.lan`)
-      kind: Rule
-      services:
-        - name: fc-devicemgmt-web
-          port: 80
-  tls:
-    secretName: fc-devicemgmt-web-tls
-
-# Future public agent/update host gate (OFF by default):
-#
-# Do not enable `update.flowercore.io` here until Authentik OIDC Q-OIDC-1
-# resolves the public-device-management auth model and route ownership with
-# UpdateCenter. When enabled, use a separate public IngressRoute with an
-# explicit Method allowlist, public-host auth middleware, and public TLS
-# certificate strategy. Leaving this as comments keeps ArgoCD from stealing
-# live UpdateCenter traffic.
-#
-# apiVersion: traefik.io/v1alpha1
-# kind: IngressRoute
-# metadata:
-#   name: fc-devicemgmt-web-public
-#   namespace: fc-devicemgmt
-#   annotations:
-#     flowercore.io/public-host-gate: "disabled-until-Q-OIDC-1"
-# spec:
-#   entryPoints:
-#     - websecure
-#   routes:
-#     - match: Host(`update.flowercore.io`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
-#       kind: Rule
-#       services:
-#         - name: fc-devicemgmt-web
-#           port: 80
-#   tls:
-#     secretName: fc-devicemgmt-public-tls
--- a/apps/fc-devicemgmt/namespace.yaml
+++ b/apps/fc-devicemgmt/namespace.yaml
@@ -1,13 +0,0 @@
-# FlowerCore.DeviceManagement namespace.
-#
-# ArgoCD discovers this directory as Application `infra-fc-devicemgmt`.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
--- a/apps/fc-devicemgmt/network-policy.yaml
+++ b/apps/fc-devicemgmt/network-policy.yaml
@@ -1,224 +0,0 @@
-# FlowerCore.DeviceManagement NetworkPolicies.
-#
-# NetworkPolicies belong in bluejay-infra so ArgoCD owns rebuild state.
-# Rules include Traefik post-DNAT backend ports per
-# feedback_netpol_dnat_backend_port and Synology NFS egress for the requested
-# cold-tier / future artifact path.
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: fc-devicemgmt-web-isolation
-  namespace: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-web
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-spec:
-  podSelector:
-    matchLabels:
-      app: fc-devicemgmt-web
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    # LAN edge: only cluster Traefik should reach the Web pod for
-    # devices.iamworkin.lan.
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-    # Direct LAN diagnostics are allowed only from FlowerCore LAN/VPN ranges.
-    - from:
-        - ipBlock:
-            cidr: 10.0.56.0/24
-        - ipBlock:
-            cidr: 10.0.57.0/24
-        - ipBlock:
-            cidr: 10.0.58.0/24
-        - ipBlock:
-            cidr: 10.0.68.0/27
-      ports:
-        - port: 8080
-          protocol: TCP
-  egress:
-    # CoreDNS.
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-    # Database namespace.
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: fc-mysql
-      ports:
-        - port: 3306
-          protocol: TCP
-    # Redis backplane for multi-replica SignalR / live-status fan-out.
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: fc-redis
-      ports:
-        - port: 6379
-          protocol: TCP
-    # Traefik VIP / in-cluster Traefik for self-callbacks and public URL
-    # generation tests. Include post-DNAT backend ports 8443 + 8080.
-    - to:
-        - ipBlock:
-            cidr: 10.0.56.200/32
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
-      ports:
-        - port: 80
-          protocol: TCP
-        - port: 443
-          protocol: TCP
-        - port: 8080
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-    # Agent egress: LAN/VPN devices may run DM Agent in Generic, Kiosk, Pi,
-    # ThinClient, or Server mode. Keep this private-range only.
-    - to:
-        - ipBlock:
-            cidr: 10.0.56.0/24
-        - ipBlock:
-            cidr: 10.0.57.0/24
-        - ipBlock:
-            cidr: 10.0.58.0/24
-        - ipBlock:
-            cidr: 10.0.68.0/27
-      ports:
-        - port: 80
-          protocol: TCP
-        - port: 443
-          protocol: TCP
-        - port: 8080
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-        - port: 5000
-          protocol: TCP
-        - port: 5001
-          protocol: TCP
-    # Synology NFS cold-tier / artifact mount allowance.
-    - to:
-        - ipBlock:
-            cidr: 10.0.58.3/32
-      ports:
-        - port: 2049
-          protocol: TCP
-        - port: 2049
-          protocol: UDP
-        - port: 111
-          protocol: TCP
-        - port: 111
-          protocol: UDP
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: fc-devicemgmt-operator-isolation
-  namespace: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-operator
-    app.kubernetes.io/component: operator
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-spec:
-  podSelector:
-    matchLabels:
-      app: fc-devicemgmt-operator
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-      ports:
-        - port: 8080
-          protocol: TCP
-  egress:
-    # CoreDNS.
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-    # Kubernetes API for KubeOps reconciliation and Deployment UID lookup.
-    - to: []
-      ports:
-        - port: 443
-          protocol: TCP
-        - port: 6443
-          protocol: TCP
-    # Agent egress for operator-initiated probes / fallback command dispatch.
-    - to:
-        - ipBlock:
-            cidr: 10.0.56.0/24
-        - ipBlock:
-            cidr: 10.0.57.0/24
-        - ipBlock:
-            cidr: 10.0.58.0/24
-        - ipBlock:
-            cidr: 10.0.68.0/27
-      ports:
-        - port: 80
-          protocol: TCP
-        - port: 443
-          protocol: TCP
-        - port: 8080
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-        - port: 5000
-          protocol: TCP
-        - port: 5001
-          protocol: TCP
-    # Synology NFS allowance for future cold-tier/audit archival jobs.
-    - to:
-        - ipBlock:
-            cidr: 10.0.58.3/32
-      ports:
-        - port: 2049
-          protocol: TCP
-        - port: 2049
-          protocol: UDP
-        - port: 111
-          protocol: TCP
-        - port: 111
-          protocol: UDP
--- a/apps/fc-devicemgmt/service-web.yaml
+++ b/apps/fc-devicemgmt/service-web.yaml
@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: fc-devicemgmt-web
-  namespace: fc-devicemgmt
-  labels:
-    app: fc-devicemgmt-web
-    app.kubernetes.io/name: fc-devicemgmt-web
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-spec:
-  type: ClusterIP
-  selector:
-    app: fc-devicemgmt-web
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP
--- a/apps/fc-devicemgmt/serviceaccount-operator.yaml
+++ b/apps/fc-devicemgmt/serviceaccount-operator.yaml
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fc-devicemgmt-operator
-  namespace: fc-devicemgmt
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt-operator
-    app.kubernetes.io/component: operator
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
--- a/apps/fc-distribution/fc-distribution.yaml
+++ b/apps/fc-distribution/fc-distribution.yaml
@@ -74,14 +74,6 @@ metadata:
 spec:
  itemPath: "vaults/IAmWorkin/items/FlowerCore Edition Signing Key - edition:aistation-field"
 ---
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: distribution-oidc-client
-  namespace: fc-distribution
-spec:
-  itemPath: "vaults/IAmWorkin/items/distribution-oidc-client"
---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -138,30 +130,6 @@ spec:
              value: "Production"
            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
              value: "false"
-            - name: FlowerCore__Auth__Enabled
-              value: "true"
-            - name: FlowerCore__Auth__Oidc__Enabled
-              value: "true"
-            - name: FlowerCore__Auth__Oidc__Authority
-              valueFrom:
-                secretKeyRef:
-                  name: distribution-oidc-client
-                  key: issuer_url
-                  optional: true
-            - name: FlowerCore__Auth__Oidc__Audience
-              value: "distribution"
-            - name: FlowerCore__Auth__Oidc__ClientId
-              valueFrom:
-                secretKeyRef:
-                  name: distribution-oidc-client
-                  key: client_id
-                  optional: true
-            - name: FlowerCore__Auth__Oidc__ClientSecret
-              valueFrom:
-                secretKeyRef:
-                  name: distribution-oidc-client
-                  key: client_secret
-                  optional: true
            # SQLite connection (catalog + data-protection keys via FlowerCoreDbContext).
            # Read by Data/DatabaseProviderExtensions.cs in precedence order; Sqlite key wins.
            - name: FlowerCore__Database__Provider
--- a/apps/fc-divoom-dm-pi-device/README.md
+++ b/apps/fc-divoom-dm-pi-device/README.md
@@ -1,45 +0,0 @@
-# FlowerCore Divoom DM Pi Device
-
-Source-controlled Puppet/Hiera deployment contract for registering the edge2
-Divoom MiniToo panel as a FlowerCore DeviceManagement-managed Pi device.
-
-This is not a Kubernetes application. The live panel remains the existing
-edge2 `flowercore-divoom.service` managed by `FlowerCore.Puppet`
-`profile::pi::service::divoom`, with the .NET payload deployed out of band
-and `/opt/flowercore/divoom/data` plus the Bluetooth shell wrappers preserved.
-Because edge2 is already Hiera-driven through `profile::pi::service::apps`,
-the deploy home is additive `profile::pi::service` data/profile source, not
-`profile::edge::service::apps` and not an ArgoCD/K8s app.
-
-## Scope
-
- Stage DeviceManagement registration metadata for the edge2 Divoom MiniToo.
- Stage a separate, disabled-by-default DM Agent executor unit for privileged
-  Bluetooth operations once the DM-RPC lane lands.
- Keep `flowercore-divoom.service` and `flowercore-divoom-bt.service`
-  untouched: no service replacement, no restart subscription, no K8s surface.
- Preserve the current wrapper contract:
-  `/opt/flowercore/divoom/bt-link.sh`,
-  `/opt/flowercore/divoom/bt-reset.sh`, and
-  `/opt/flowercore/divoom/audio-link.sh`.
- Keep FM radio disabled and require visible render proof; device-info echo is
-  not render proof.
-
-## Artifact Map
-
-| Path | Use |
-| --- | --- |
-| `hiera/edge2-divoom-dm-device.overlay.yaml` | Additive Hiera overlay for edge2. Merge into the existing node YAML without removing `fc-pimanager` or `fc-divoom`. |
-| `puppet/profile/pi/service/divoom_dm_device.pp` | Puppet profile shape to vendor into `FlowerCore.Puppet` after the DM-RPC executor binary exists. |
-| `puppet/templates/divoom-device-registration.json.epp` | DM device registration metadata rendered on edge2. |
-| `puppet/templates/flowercore-divoom-dm-agent.service.epp` | Separate DM Agent systemd unit. Defaults are stopped and disabled until a later cutover. |
-
-## Rollout Notes
-
-1. Land these artifacts in bluejay-infra as the deploy contract.
-2. Vendor the Puppet profile and EPP templates into `FlowerCore.Puppet`.
-3. Merge the Hiera overlay into `data/nodes/edge2.iamworkin.lan.yaml`.
-4. Run Puppet in noop first, preferably with a node-local validation directory
-   under `~/.fcv` rather than `/tmp`.
-5. Only enable the DM Agent service after the DeviceManagement BT executor has
-   landed and passed operator-eyeball render proof.
--- a/apps/fc-divoom-dm-pi-device/hiera/edge2-divoom-dm-device.overlay.yaml
+++ b/apps/fc-divoom-dm-pi-device/hiera/edge2-divoom-dm-device.overlay.yaml
@@ -1,32 +0,0 @@
---
-# Merge into FlowerCore.Puppet data/nodes/edge2.iamworkin.lan.yaml.
-# Additive overlay only: keep the existing fc-pimanager version/tarball entry,
-# keep fc-divoom enabled, and do not move Divoom into Kubernetes.
-
-profile::pi::service::apps:
-  fc-pimanager:
-    binary: 'FlowerCore.PiManager.Web'
-    install_dir: '/opt/fc-pimanager'
-    port: 5000
-    environment: 'edge2'
-    version: '2026.05.28.1646'
-    tarball_source: 'puppet:///modules/profile/pi/builds/fc-pimanager.tar.gz'
-  fc-divoom:
-    enabled: true
-
-profile::pi::service::divoom_dm_device::ensure: 'present'
-profile::pi::service::divoom_dm_device::service_enabled: false
-profile::pi::service::divoom_dm_device::service_ensure: 'stopped'
-profile::pi::service::divoom_dm_device::device_id: 'edge2-divoom-minitoo'
-profile::pi::service::divoom_dm_device::display_name: 'edge2 Divoom MiniToo'
-profile::pi::service::divoom_dm_device::host_fqdn: 'edge2.iamworkin.lan'
-profile::pi::service::divoom_dm_device::dm_web_url: 'https://devicemgmt.iamworkin.lan'
-profile::pi::service::divoom_dm_device::divoom_install_dir: '/opt/flowercore/divoom'
-profile::pi::service::divoom_dm_device::agent_install_dir: '/opt/flowercore/devicemanagement-agent'
-profile::pi::service::divoom_dm_device::bt_candidate_channels:
-  - '1'
-  - '10'
-profile::pi::service::divoom_dm_device::default_bt_channel: '1'
-profile::pi::service::divoom_dm_device::a2dp_default_state: 'off'
-profile::pi::service::divoom_dm_device::fm_radio_enabled: false
-profile::pi::service::divoom_dm_device::visible_render_proof_required: true
--- a/apps/fc-divoom-dm-pi-device/puppet/profile/pi/service/divoom_dm_device.pp
+++ b/apps/fc-divoom-dm-pi-device/puppet/profile/pi/service/divoom_dm_device.pp
@@ -1,140 +0,0 @@
-# Drop into FlowerCore.Puppet site-modules/profile/manifests/pi/service/divoom_dm_device.pp.
-# This profile is additive to profile::pi::service::divoom. It must not manage,
-# restart, replace, or subscribe the existing flowercore-divoom.service.
-class profile::pi::service::divoom_dm_device (
-  Enum['present', 'absent'] $ensure = 'present',
-  Boolean $service_enabled = false,
-  Enum['running', 'stopped'] $service_ensure = 'stopped',
-  String $service_name = 'flowercore-divoom-dm-agent',
-  String $device_id = 'edge2-divoom-minitoo',
-  String $display_name = 'edge2 Divoom MiniToo',
-  String $host_fqdn = 'edge2.iamworkin.lan',
-  String $dm_web_url = 'https://devicemgmt.iamworkin.lan',
-  String $divoom_install_dir = '/opt/flowercore/divoom',
-  String $agent_install_dir = '/opt/flowercore/devicemanagement-agent',
-  String $agent_binary = 'FlowerCore.DeviceManagement.Agent',
-  Array[String] $bt_candidate_channels = ['1', '10'],
-  String $default_bt_channel = '1',
-  Enum['on', 'off'] $a2dp_default_state = 'off',
-  Boolean $fm_radio_enabled = false,
-  Boolean $visible_render_proof_required = true,
-) {
-  include profile::workstation::safe_account_exclusion
-
-  $safe_account = $profile::workstation::safe_account_exclusion::safe_account
-  $config_dir = '/etc/flowercore/device-management/devices'
-  $state_dir = '/var/lib/flowercore/divoom-dm-agent'
-  $log_dir = '/var/log/flowercore/divoom-dm-agent'
-  $registration_path = "${config_dir}/${device_id}.json"
-  $agent_binary_path = "${agent_install_dir}/${agent_binary}"
-  $bt_channels_json = inline_template('[<%= @bt_candidate_channels.map { |c| "\"#{c}\"" }.join(", ") %>]')
-
-  if $safe_account {
-    notify { 'fc-divoom-dm-device safe-account exclusion':
-      message => 'SAFE-ACCOUNT-EXCLUSION: Divoom DM Pi device profile refused to apply on operator workstation',
-    }
-
-    if $facts['os']['family'] != 'windows' {
-      ensure_resource('file', '/var/log/flowercore-audit', {
-          'ensure' => 'directory',
-          'owner'  => 'root',
-          'group'  => 'root',
-          'mode'   => '0755',
-      })
-
-      file { '/var/log/flowercore-audit/safe-account-noop-fc-divoom-dm-device.log':
-        ensure  => file,
-        owner   => 'root',
-        group   => 'root',
-        mode    => '0644',
-        content => "noop: divoom dm pi device profile refused to apply on safe-account host\n",
-        require => File['/var/log/flowercore-audit'],
-      }
-    }
-  } elsif $ensure == 'absent' {
-    service { $service_name:
-      ensure => stopped,
-      enable => false,
-    }
-
-    file { [
-        "/etc/systemd/system/${service_name}.service",
-        $registration_path,
-      ]:
-      ensure => absent,
-    }
-
-    exec { 'fc-divoom-dm-agent-systemd-reload':
-      command     => '/usr/bin/systemctl daemon-reload',
-      refreshonly => true,
-      path        => ['/usr/bin', '/bin'],
-    }
-  } else {
-    case $facts['os']['family'] {
-      'Debian': {}
-      default: { fail("profile::pi::service::divoom_dm_device only supports Debian-family OS, got ${facts['os']['family']}") }
-    }
-
-    file { [$config_dir, $state_dir, $log_dir]:
-      ensure => directory,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0755',
-    }
-
-    file { $registration_path:
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => epp('profile/pi/fc_divoom_dm/divoom-device-registration.json.epp', {
-        'device_id'                     => $device_id,
-        'display_name'                  => $display_name,
-        'host_fqdn'                     => $host_fqdn,
-        'divoom_install_dir'            => $divoom_install_dir,
-        'bt_channels_json'              => $bt_channels_json,
-        'default_bt_channel'            => $default_bt_channel,
-        'a2dp_default_state'            => $a2dp_default_state,
-        'fm_radio_enabled'              => $fm_radio_enabled,
-        'visible_render_proof_required' => $visible_render_proof_required,
-      }),
-      require => File[$config_dir],
-    }
-
-    file { "/etc/systemd/system/${service_name}.service":
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => epp('profile/pi/fc_divoom_dm/flowercore-divoom-dm-agent.service.epp', {
-        'service_name'       => $service_name,
-        'device_id'          => $device_id,
-        'dm_web_url'         => $dm_web_url,
-        'registration_path'  => $registration_path,
-        'divoom_install_dir' => $divoom_install_dir,
-        'agent_install_dir'  => $agent_install_dir,
-        'agent_binary_path'  => $agent_binary_path,
-        'state_dir'          => $state_dir,
-        'log_dir'            => $log_dir,
-      }),
-      notify  => Exec['fc-divoom-dm-agent-systemd-reload'],
-      require => File[$registration_path],
-    }
-
-    exec { 'fc-divoom-dm-agent-systemd-reload':
-      command     => '/usr/bin/systemctl daemon-reload',
-      refreshonly => true,
-      path        => ['/usr/bin', '/bin'],
-    }
-
-    service { $service_name:
-      ensure  => $service_ensure,
-      enable  => $service_enabled,
-      require => [
-        File["/etc/systemd/system/${service_name}.service"],
-        File[$registration_path],
-        Exec['fc-divoom-dm-agent-systemd-reload'],
-      ],
-    }
-  }
-}
--- a/apps/fc-divoom-dm-pi-device/puppet/templates/divoom-device-registration.json.epp
+++ b/apps/fc-divoom-dm-pi-device/puppet/templates/divoom-device-registration.json.epp
@@ -1,34 +0,0 @@
-{
-  "deviceId": "<%= $device_id %>",
-  "displayName": "<%= $display_name %>",
-  "hostFqdn": "<%= $host_fqdn %>",
-  "kind": "DivoomMiniToo",
-  "managedBy": "FlowerCore.DeviceManagement",
-  "executionMode": "Pi",
-  "transport": {
-    "kind": "BluetoothSerial",
-    "candidateChannels": <%= $bt_channels_json %>,
-    "defaultChannel": "<%= $default_bt_channel %>",
-    "deviceInfoIsRenderProof": false,
-    "visibleRenderProofRequired": <%= $visible_render_proof_required %>
-  },
-  "paths": {
-    "divoomInstallDir": "<%= $divoom_install_dir %>",
-    "btLink": "<%= $divoom_install_dir %>/bt-link.sh",
-    "btReset": "<%= $divoom_install_dir %>/bt-reset.sh",
-    "audioLink": "<%= $divoom_install_dir %>/audio-link.sh"
-  },
-  "capabilities": {
-    "supportsBluetoothSerial": true,
-    "supportsBtChannelRedetect": true,
-    "supportsBtHardReset": true,
-    "supportsBtAudioProfileSwitch": true,
-    "a2dpDefaultState": "<%= $a2dp_default_state %>",
-    "fmRadioEnabled": <%= $fm_radio_enabled %>
-  },
-  "safety": {
-    "preserveExistingService": "flowercore-divoom.service",
-    "preserveDataDirectory": "<%= $divoom_install_dir %>/data",
-    "doNotEnableFmRadio": true
-  }
-}
--- a/apps/fc-divoom-dm-pi-device/puppet/templates/flowercore-divoom-dm-agent.service.epp
+++ b/apps/fc-divoom-dm-pi-device/puppet/templates/flowercore-divoom-dm-agent.service.epp
@@ -1,36 +0,0 @@
-[Unit]
-Description=FlowerCore Divoom DM Agent Bluetooth executor
-Documentation=https://github.com/astoltz/FlowerCore.Notes/blob/master/docs/standards/divoom-tv-hdmi-multitarget-render-substrate.md
-Wants=network-online.target
-After=network-online.target bluetooth.service
-Requires=bluetooth.service
-ConditionPathExists=<%= $agent_binary_path %>
-ConditionPathExists=<%= $registration_path %>
-ConditionPathExists=<%= $divoom_install_dir %>/bt-link.sh
-ConditionPathExists=<%= $divoom_install_dir %>/bt-reset.sh
-ConditionPathExists=<%= $divoom_install_dir %>/audio-link.sh
-
-[Service]
-Type=simple
-User=stoltz
-Group=stoltz
-WorkingDirectory=<%= $agent_install_dir %>
-Environment=DOTNET_CLI_TELEMETRY_OPTOUT=1
-Environment=FLOWERCORE_DM_DEVICE_REGISTRATION=<%= $registration_path %>
-Environment=Divoom__Bluetooth__DeviceInfoIsRenderProof=false
-Environment=Divoom__Bluetooth__VisibleRenderProofRequired=true
-Environment=Divoom__Bluetooth__A2dpDefaultState=off
-ExecStart=<%= $agent_binary_path %> --mode=Pi --device-id=<%= $device_id %> --dm-web-url=<%= $dm_web_url %> --registration=<%= $registration_path %>
-Restart=on-failure
-RestartSec=10s
-StartLimitBurst=3
-StartLimitIntervalSec=300s
-SupplementaryGroups=bluetooth audio dialout
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=<%= $state_dir %> <%= $log_dir %>
-
-[Install]
-WantedBy=multi-user.target
--- a/apps/fc-divoom-tv-pi/README.md
+++ b/apps/fc-divoom-tv-pi/README.md
@@ -1,44 +0,0 @@
-# FlowerCore Divoom TV Pi HDMI
-
-Source-controlled deploy shape for the native `FlowerCore.Divoom.Tv`
-Avalonia HDMI renderer on a Raspberry Pi connected to a TV.
-
-This is a Puppet/systemd appliance bundle, not a Kubernetes application. It
-mirrors the existing `fc-signage-pi-player` pattern: bluejay-infra carries the
-systemd units, scripts, Hiera shape, and Puppet profile source that
-`FlowerCore.Puppet` vendors and installs.
-
-## Scope
-
- Launch the future `FlowerCore.Divoom.Tv` linux-arm64 self-contained payload
-  from `/opt/flowercore/divoom-tv/FlowerCore.Divoom.Tv`.
- Prefer `cage` as the Wayland fullscreen compositor, with direct app launch as
-  a fallback for development images.
- Restart the app after HDMI hotplug with a 2 second DRM settle delay.
- Keep all runtime state local: `/var/lib/fc-divoom-tv` and
-  `/var/log/fc-divoom-tv`.
- Avoid CDN/runtime fetches; the app renders the in-house Divoom scene catalog
-  locally.
-
-## Artifact Map
-
-| Path | Use |
-| --- | --- |
-| `systemd/flowercore-divoom-tv.service` | Fullscreen Avalonia HDMI app service. |
-| `systemd/flowercore-divoom-tv-hdmi.service` | HDMI hotplug responder service. |
-| `systemd/99-flowercore-divoom-tv-hdmi.rules` | DRM udev hotplug rule. |
-| `scripts/flowercore-divoom-tv-prelaunch.sh` | Preflight checks and local directory creation. |
-| `scripts/flowercore-divoom-tv-launch.sh` | Cage-first fullscreen launcher. |
-| `scripts/flowercore-divoom-tv-hdmi-respond.sh` | Hotplug settle and restart script. |
-| `puppet/profile/pi/service/divoom_tv.pp` | Puppet profile shape to vendor into `FlowerCore.Puppet`. |
-| `hiera/example-divoom-tv-pi.iamworkin.lan.yaml` | Example node Hiera for a Divoom TV Pi. |
-
-## Rollout Notes
-
-1. Build `FlowerCore.Divoom.Tv` with `dotnet.exe publish -c Release -r linux-arm64 --self-contained`.
-2. Stage the payload to `/opt/flowercore/divoom-tv/` through the standard noc1
-   jump path and avoid `/tmp` for unprivileged Pi scratch.
-3. Vendor the profile and static files into `FlowerCore.Puppet`.
-4. Run Puppet noop, then apply on the target Pi.
-5. Prove deployment with `systemctl is-active flowercore-divoom-tv.service`,
-   journal lines showing frames presented, and a visible HDMI display check.
--- a/apps/fc-divoom-tv-pi/hiera/example-divoom-tv-pi.iamworkin.lan.yaml
+++ b/apps/fc-divoom-tv-pi/hiera/example-divoom-tv-pi.iamworkin.lan.yaml
@@ -1,19 +0,0 @@
---
-# Example node data for a dedicated Pi -> HDMI -> TV Divoom renderer.
-# Copy into FlowerCore.Puppet data/nodes/<hostname>.iamworkin.lan.yaml only
-# after the Pi has a static DHCP/DNS entry and the linux-arm64 payload exists.
-
-facts:
-  role: pi_prototype
-
-profile::motd::role: 'Divoom TV HDMI Renderer'
-
-profile::pi::service::divoom_tv::ensure: 'present'
-profile::pi::service::divoom_tv::service_enabled: true
-profile::pi::service::divoom_tv::service_ensure: 'running'
-profile::pi::service::divoom_tv::install_dir: '/opt/flowercore/divoom-tv'
-profile::pi::service::divoom_tv::state_dir: '/var/lib/fc-divoom-tv'
-profile::pi::service::divoom_tv::log_dir: '/var/log/fc-divoom-tv'
-profile::pi::service::divoom_tv::presentation_mode: 'PillarboxSquare'
-profile::pi::service::divoom_tv::startup_scene: 'bluejay-clock'
-profile::pi::service::divoom_tv::reduced_motion: false
--- a/apps/fc-divoom-tv-pi/puppet/profile/pi/service/divoom_tv.pp
+++ b/apps/fc-divoom-tv-pi/puppet/profile/pi/service/divoom_tv.pp
@@ -1,149 +0,0 @@
-# Drop into FlowerCore.Puppet site-modules/profile/manifests/pi/service/divoom_tv.pp.
-# Static files come from profile/pi/fc_divoom_tv/ after this bluejay-infra
-# bundle is vendored into the Puppet control repo.
-class profile::pi::service::divoom_tv (
-  Enum['present', 'absent'] $ensure = 'present',
-  Boolean $service_enabled = false,
-  Enum['running', 'stopped'] $service_ensure = 'stopped',
-  String $service_name = 'flowercore-divoom-tv',
-  String $user = 'fc-divoom-tv',
-  String $group = 'fc-divoom-tv',
-  String $install_dir = '/opt/flowercore/divoom-tv',
-  String $state_dir = '/var/lib/fc-divoom-tv',
-  String $log_dir = '/var/log/fc-divoom-tv',
-  String $presentation_mode = 'PillarboxSquare',
-  String $startup_scene = 'bluejay-clock',
-  Boolean $reduced_motion = false,
-) {
-  include profile::workstation::safe_account_exclusion
-
-  $safe_account = $profile::workstation::safe_account_exclusion::safe_account
-
-  if $safe_account {
-    notify { 'fc-divoom-tv safe-account exclusion':
-      message => 'SAFE-ACCOUNT-EXCLUSION: Divoom TV Pi profile refused to apply on operator workstation',
-    }
-  } elsif $ensure == 'absent' {
-    service { $service_name:
-      ensure => stopped,
-      enable => false,
-    }
-
-    file { [
-        "/etc/systemd/system/${service_name}.service",
-        "/etc/systemd/system/${service_name}-hdmi.service",
-        '/etc/udev/rules.d/99-flowercore-divoom-tv-hdmi.rules',
-        '/usr/local/bin/flowercore-divoom-tv-prelaunch.sh',
-        '/usr/local/bin/flowercore-divoom-tv-launch.sh',
-        '/usr/local/bin/flowercore-divoom-tv-hdmi-respond.sh',
-        '/etc/flowercore/divoom-tv.env',
-      ]:
-      ensure => absent,
-    }
-  } else {
-    case $facts['os']['family'] {
-      'Debian': {}
-      default: { fail("profile::pi::service::divoom_tv only supports Debian-family OS, got ${facts['os']['family']}") }
-    }
-
-    package { ['cage', 'libgbm1', 'libdrm2', 'libxkbcommon0', 'fonts-dejavu-core']:
-      ensure => installed,
-    }
-
-    group { $group:
-      ensure => present,
-      system => true,
-    }
-
-    user { $user:
-      ensure     => present,
-      system     => true,
-      gid        => $group,
-      home       => $state_dir,
-      managehome => false,
-      shell      => '/usr/sbin/nologin',
-      require    => Group[$group],
-    }
-
-    file { [$install_dir, $state_dir, $log_dir, '/etc/flowercore']:
-      ensure => directory,
-      owner  => $user,
-      group  => $group,
-      mode   => '0755',
-    }
-
-    file { '/etc/flowercore/divoom-tv.env':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => "FC_DIVOOM_TV_PRESENTATION_MODE=${presentation_mode}\nFC_DIVOOM_TV_START_SCENE=${startup_scene}\nFC_DIVOOM_TV_REDUCED_MOTION=${reduced_motion}\n",
-      require => File['/etc/flowercore'],
-    }
-
-    $script_map = {
-      '/usr/local/bin/flowercore-divoom-tv-prelaunch.sh'    => 'profile/pi/fc_divoom_tv/flowercore-divoom-tv-prelaunch.sh',
-      '/usr/local/bin/flowercore-divoom-tv-launch.sh'       => 'profile/pi/fc_divoom_tv/flowercore-divoom-tv-launch.sh',
-      '/usr/local/bin/flowercore-divoom-tv-hdmi-respond.sh' => 'profile/pi/fc_divoom_tv/flowercore-divoom-tv-hdmi-respond.sh',
-    }
-
-    $script_map.each |$dest, $src| {
-      file { $dest:
-        ensure => file,
-        owner  => 'root',
-        group  => 'root',
-        mode   => '0755',
-        source => "puppet:///modules/${src}",
-      }
-    }
-
-    $unit_map = {
-      "/etc/systemd/system/${service_name}.service"      => 'profile/pi/fc_divoom_tv/flowercore-divoom-tv.service',
-      "/etc/systemd/system/${service_name}-hdmi.service" => 'profile/pi/fc_divoom_tv/flowercore-divoom-tv-hdmi.service',
-    }
-
-    $unit_map.each |$dest, $src| {
-      file { $dest:
-        ensure => file,
-        owner  => 'root',
-        group  => 'root',
-        mode   => '0644',
-        source => "puppet:///modules/${src}",
-        notify => Exec['fc-divoom-tv-systemd-reload'],
-      }
-    }
-
-    file { '/etc/udev/rules.d/99-flowercore-divoom-tv-hdmi.rules':
-      ensure => file,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0644',
-      source => 'puppet:///modules/profile/pi/fc_divoom_tv/99-flowercore-divoom-tv-hdmi.rules',
-      notify => Exec['fc-divoom-tv-udev-reload'],
-    }
-
-    exec { 'fc-divoom-tv-systemd-reload':
-      command     => '/usr/bin/systemctl daemon-reload',
-      refreshonly => true,
-      path        => ['/usr/bin', '/bin'],
-    }
-
-    exec { 'fc-divoom-tv-udev-reload':
-      command     => '/usr/bin/udevadm control --reload-rules',
-      refreshonly => true,
-      path        => ['/usr/bin', '/bin'],
-    }
-
-    service { $service_name:
-      ensure  => $service_ensure,
-      enable  => $service_enabled,
-      require => [
-        File["/etc/systemd/system/${service_name}.service"],
-        File['/etc/flowercore/divoom-tv.env'],
-        File['/usr/local/bin/flowercore-divoom-tv-prelaunch.sh'],
-        File['/usr/local/bin/flowercore-divoom-tv-launch.sh'],
-        Exec['fc-divoom-tv-systemd-reload'],
-      ],
-    }
-  }
-}
--- a/apps/fc-divoom-tv-pi/scripts/flowercore-divoom-tv-hdmi-respond.sh
+++ b/apps/fc-divoom-tv-pi/scripts/flowercore-divoom-tv-hdmi-respond.sh
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-sleep 2
-systemctl restart flowercore-divoom-tv.service
--- a/apps/fc-divoom-tv-pi/scripts/flowercore-divoom-tv-launch.sh
+++ b/apps/fc-divoom-tv-pi/scripts/flowercore-divoom-tv-launch.sh
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-APP_BIN="${FC_DIVOOM_TV_BIN:-/opt/flowercore/divoom-tv/FlowerCore.Divoom.Tv}"
-STATE_DIR="${FC_DIVOOM_TV_STATE_DIR:-/var/lib/fc-divoom-tv}"
-LOG_DIR="${FC_DIVOOM_TV_LOG_DIR:-/var/log/fc-divoom-tv}"
-PRESENTATION_MODE="${FC_DIVOOM_TV_PRESENTATION_MODE:-PillarboxSquare}"
-START_SCENE="${FC_DIVOOM_TV_START_SCENE:-bluejay-clock}"
-REDUCED_MOTION="${FC_DIVOOM_TV_REDUCED_MOTION:-false}"
-
-COMMON_ARGS=(
-  "--target=hdmi"
-  "--presentation-mode=${PRESENTATION_MODE}"
-  "--startup-scene=${START_SCENE}"
-  "--reduced-motion=${REDUCED_MOTION}"
-  "--state-dir=${STATE_DIR}"
-  "--log-dir=${LOG_DIR}"
-)
-
-if command -v cage >/dev/null 2>&1; then
-  exec cage -- "${APP_BIN}" "${COMMON_ARGS[@]}" "$@"
-fi
-
-echo "[$(date -Is)] cage not found; launching FlowerCore.Divoom.Tv directly" >&2
-exec "${APP_BIN}" "${COMMON_ARGS[@]}" "$@"
--- a/apps/fc-divoom-tv-pi/scripts/flowercore-divoom-tv-prelaunch.sh
+++ b/apps/fc-divoom-tv-pi/scripts/flowercore-divoom-tv-prelaunch.sh
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-APP_BIN="${FC_DIVOOM_TV_BIN:-/opt/flowercore/divoom-tv/FlowerCore.Divoom.Tv}"
-STATE_DIR="${FC_DIVOOM_TV_STATE_DIR:-/var/lib/fc-divoom-tv}"
-LOG_DIR="${FC_DIVOOM_TV_LOG_DIR:-/var/log/fc-divoom-tv}"
-
-mkdir -p "${STATE_DIR}" "${LOG_DIR}"
-
-if [[ ! -x "${APP_BIN}" ]]; then
-  echo "[$(date -Is)] missing executable ${APP_BIN}" >&2
-  exit 1
-fi
-
-if [[ -d /sys/class/drm ]] && ! find /sys/class/drm -maxdepth 1 -name 'card*-HDMI-A-*' -print -quit | grep -q .; then
-  echo "[$(date -Is)] no HDMI connector visible yet; continuing so the app can wait for display" >&2
-fi
-
-if command -v cage >/dev/null 2>&1; then
-  echo "[$(date -Is)] cage available for fullscreen Wayland launch"
-else
-  echo "[$(date -Is)] cage not installed; direct launch fallback will be used" >&2
-fi
--- a/apps/fc-divoom-tv-pi/systemd/99-flowercore-divoom-tv-hdmi.rules
+++ b/apps/fc-divoom-tv-pi/systemd/99-flowercore-divoom-tv-hdmi.rules
@@ -1,2 +0,0 @@
-# Settle DRM for 2s before restarting the fullscreen Avalonia renderer.
-SUBSYSTEM=="drm", KERNEL=="card?-HDMI-A-?", ACTION=="change", RUN+="/usr/bin/systemctl start flowercore-divoom-tv-hdmi.service"
--- a/apps/fc-divoom-tv-pi/systemd/flowercore-divoom-tv-hdmi.service
+++ b/apps/fc-divoom-tv-pi/systemd/flowercore-divoom-tv-hdmi.service
@@ -1,7 +0,0 @@
-[Unit]
-Description=FlowerCore Divoom TV HDMI hotplug responder
-DefaultDependencies=no
-
-[Service]
-Type=oneshot
-ExecStart=/usr/local/bin/flowercore-divoom-tv-hdmi-respond.sh
--- a/apps/fc-divoom-tv-pi/systemd/flowercore-divoom-tv.service
+++ b/apps/fc-divoom-tv-pi/systemd/flowercore-divoom-tv.service
@@ -1,40 +0,0 @@
-[Unit]
-Description=FlowerCore Divoom TV HDMI Renderer (Avalonia fullscreen)
-Documentation=https://github.com/astoltz/FlowerCore.Notes/blob/master/docs/standards/divoom-tv-hdmi-multitarget-render-substrate.md
-Wants=network-online.target
-After=network-online.target systemd-user-sessions.service
-ConditionPathExists=/opt/flowercore/divoom-tv/FlowerCore.Divoom.Tv
-
-[Service]
-Type=simple
-User=fc-divoom-tv
-Group=fc-divoom-tv
-WorkingDirectory=/opt/flowercore/divoom-tv
-EnvironmentFile=-/etc/flowercore/divoom-tv.env
-Environment=DOTNET_CLI_TELEMETRY_OPTOUT=1
-Environment=XDG_RUNTIME_DIR=/run/fc-divoom-tv
-RuntimeDirectory=fc-divoom-tv
-RuntimeDirectoryMode=0700
-ExecStartPre=/usr/local/bin/flowercore-divoom-tv-prelaunch.sh
-ExecStart=/usr/local/bin/flowercore-divoom-tv-launch.sh
-Restart=always
-RestartSec=10s
-StartLimitBurst=5
-StartLimitIntervalSec=300s
-MemoryMax=2G
-MemoryHigh=1500M
-PrivateTmp=true
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/var/lib/fc-divoom-tv /var/log/fc-divoom-tv /run/fc-divoom-tv
-TTYPath=/dev/tty1
-StandardInput=tty
-StandardOutput=journal
-StandardError=journal
-TTYReset=yes
-TTYVHangup=yes
-TTYVTDisallocate=yes
-
-[Install]
-WantedBy=graphical.target
--- a/apps/fc-library/fc-library.yaml
+++ b/apps/fc-library/fc-library.yaml
@@ -1,169 +0,0 @@
-# FlowerCore.Library.Web GitOps adoption manifest.
-#
-# Authored from the already-live fc-library resources on 2026-06-04.
-# Keep the live image tag, Service ClusterIP, and PVC volumeName unchanged so
-# ArgoCD adopts in place instead of replacing the workload or data volume.
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: library-web-data
-  namespace: fc-library
-  labels:
-    app.kubernetes.io/name: library-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-library
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
-  volumeMode: Filesystem
-  volumeName: pvc-2690bae2-4ee0-417a-b95f-50ec5c632b63
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: library-web
-  namespace: fc-library
-  labels:
-    app.kubernetes.io/name: library-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-library
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: library-web
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        prometheus.io/path: /metrics/prometheus
-        prometheus.io/port: "5000"
-        prometheus.io/scrape: "true"
-      labels:
-        app.kubernetes.io/name: library-web
-        app.kubernetes.io/part-of: flowercore
-    spec:
-      containers:
-        - envFrom:
-            - configMapRef:
-                name: library-web-config
-          image: localhost/fc-library-web:v20260602-library-owned-deploy-fix1
-          imagePullPolicy: Never
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /health
-              port: 5000
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          name: library-web
-          ports:
-            - containerPort: 5000
-              name: http
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 6
-            httpGet:
-              path: /health
-              port: 5000
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources: {}
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: library-web-data
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: library-web
-  namespace: fc-library
-  labels:
-    app.kubernetes.io/name: library-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-library
-spec:
-  clusterIP: 10.43.179.63
-  clusterIPs:
-    - 10.43.179.63
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-    - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: 5000
-  selector:
-    app.kubernetes.io/name: library-web
-  sessionAffinity: None
-  type: ClusterIP
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: library-web-tls
-  namespace: fc-library
-  labels:
-    app.kubernetes.io/name: library-web-tls
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-library
-spec:
-  dnsNames:
-    - library.iamworkin.lan
-  issuerRef:
-    kind: ClusterIssuer
-    name: step-ca-acme
-  secretName: library-web-tls
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: library-web
-  namespace: fc-library
-  labels:
-    app.kubernetes.io/name: library-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-library
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - kind: Rule
-      match: Host(`library.iamworkin.lan`)
-      services:
-        - name: library-web
-          port: 80
-  tls:
-    secretName: library-web-tls
--- a/apps/fc-retail/fc-retail.yaml
+++ b/apps/fc-retail/fc-retail.yaml
@@ -1,170 +0,0 @@
-# FlowerCore.Retail.Web GitOps adoption manifest.
-#
-# Authored from the already-live fc-retail resources on 2026-06-04.
-# Keep the live image tag, Service ClusterIP, and PVC volumeName unchanged so
-# ArgoCD adopts in place instead of replacing the workload or data volume.
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: retail-web-data
-  namespace: fc-retail
-  labels:
-    app.kubernetes.io/name: retail-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-retail
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
-  volumeMode: Filesystem
-  volumeName: pvc-3d40b336-eab4-41b3-812c-d5e9413ce0ab
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: retail-web
-  namespace: fc-retail
-  labels:
-    app.kubernetes.io/name: retail-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-retail
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: retail-web
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-06-02T01:34:08-05:00"
-        prometheus.io/path: /metrics/prometheus
-        prometheus.io/port: "5000"
-        prometheus.io/scrape: "true"
-      labels:
-        app.kubernetes.io/name: retail-web
-        app.kubernetes.io/part-of: flowercore
-    spec:
-      containers:
-        - envFrom:
-            - configMapRef:
-                name: retail-web-config
-          image: localhost/fc-retail-web:v20260602-retail-owned-deploy-fix5
-          imagePullPolicy: Never
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /health
-              port: 5000
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          name: retail-web
-          ports:
-            - containerPort: 5000
-              name: http
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 6
-            httpGet:
-              path: /health
-              port: 5000
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources: {}
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: retail-web-data
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: retail-web
-  namespace: fc-retail
-  labels:
-    app.kubernetes.io/name: retail-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-retail
-spec:
-  clusterIP: 10.43.239.8
-  clusterIPs:
-    - 10.43.239.8
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-    - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: 5000
-  selector:
-    app.kubernetes.io/name: retail-web
-  sessionAffinity: None
-  type: ClusterIP
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: retail-web-tls
-  namespace: fc-retail
-  labels:
-    app.kubernetes.io/name: retail-web-tls
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-retail
-spec:
-  dnsNames:
-    - retail.iamworkin.lan
-  issuerRef:
-    kind: ClusterIssuer
-    name: step-ca-acme
-  secretName: retail-web-tls
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: retail-web
-  namespace: fc-retail
-  labels:
-    app.kubernetes.io/name: retail-web
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    argocd.argoproj.io/instance: infra-fc-retail
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - kind: Rule
-      match: Host(`retail.iamworkin.lan`)
-      services:
-        - name: retail-web
-          port: 80
-  tls:
-    secretName: retail-web-tls
--- a/apps/fc-ttsreader/fc-ttsreader.yaml
+++ b/apps/fc-ttsreader/fc-ttsreader.yaml
@@ -532,7 +532,7 @@ spec:
        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: web
-          image: localhost/fc-ttsreader-web:v20260603-s54cx14-pr29-schema
+          image: localhost/fc-ttsreader-web:v20260506-phase6
          imagePullPolicy: Never
          ports:
            - containerPort: 5217
@@ -554,16 +554,10 @@ spec:
              value: "/data/chapter-context.db"
            - name: TtsReader__Jobs__Root
              value: "/data/jobs"
-            - name: TtsReader__Export__LocalCasRoot
-              value: "/data/bundles/cas"
            - name: TtsReader__Piper__Host
-              value: "10.0.57.17"
+              value: "ttsreader-piper.fc-ttsreader.svc.cluster.local."
            - name: TtsReader__Piper__Port
-              value: "8500"
-            - name: TtsReader__Piper__Transport
-              value: "http"
-            - name: TtsReader__Piper__HttpPath
-              value: "/tts"
+              value: "10200"
            - name: TtsReader__Kokoro__Enabled
              value: "true"
            - name: TtsReader__Kokoro__BaseUrl
--- a/apps/fc-updater/fc-updater.yaml
+++ b/apps/fc-updater/fc-updater.yaml
@@ -58,7 +58,7 @@ spec:
      nodeName: rke2-server
      containers:
        - name: web
-          image: localhost/fc-updater-web:v202605310029-7974fc4
+          image: localhost/fc-updater-web:v20260509-4162dca-authgate
          imagePullPolicy: Never
          ports:
            - containerPort: 8080
@@ -88,8 +88,6 @@ spec:
              value: Faith AI Mike Edition
            - name: FlowerCore__Updater__PublicShares__Links__0__Description
              value: Private release link for Mike's Faith AI bundle.
-            - name: FlowerCore__Audit__Sinks__Loki__Enabled
-              value: "false"
            - name: FlowerCore__Updater__Auth__Bootstrap__Enabled
              value: "true"
            - name: FlowerCore__Updater__Auth__Bootstrap__Username
--- a/apps/github-runner/.gitattributes
+++ b/apps/github-runner/.gitattributes
@@ -1,2 +0,0 @@
-*.sh text eol=lf
-Dockerfile text eol=lf
--- a/apps/github-runner/Dockerfile
+++ b/apps/github-runner/Dockerfile
@@ -1,54 +0,0 @@
-FROM myoung34/github-runner:latest
-
-ARG RUBY_VERSION=3.3.11
-ARG RUBY_MINOR=3.3
-ARG RUBY_BUILD_VERSION=v20260326
-ARG RUNNER_UID=1001
-ARG RUNNER_GID=1001
-
-ENV RUNNER_TOOL_CACHE=/home/runner/_tool
-ENV RUNNER_RUBY_TOOLCACHE=/opt/runner-toolcache
-ENV PATH="/home/runner/_tool/Ruby/${RUBY_MINOR}/x64/bin:/opt/runner-toolcache/Ruby/${RUBY_MINOR}/x64/bin:${PATH}"
-
-USER root
-
-# Bake the IAmWorkin step-ca root CA into the system trust store. Without
-# this, .NET HttpClient calls from CI tests against *.iamworkin.lan
-# (e.g. https://selenium.iamworkin.lan/session) fail with `PartialChain`
-# because the runner image's default Ubuntu trust bundle doesn't include
-# our internal Root CA. update-ca-certificates regenerates
-# /etc/ssl/certs/ca-certificates.crt, which OpenSSL + .NET on Linux read
-# automatically — no SSL_CERT_FILE env var needed.
-COPY step-ca-root.crt /usr/local/share/ca-certificates/iamworkin-step-ca-root.crt
-
-RUN apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-        autoconf \
-        bison \
-        build-essential \
-        ca-certificates \
-        curl \
-        libdb-dev \
-        libffi-dev \
-        libgdbm-dev \
-        libgmp-dev \
-        libncurses-dev \
-        libreadline-dev \
-        libssl-dev \
-        libyaml-dev \
-        patch \
-        pkg-config \
-        uuid-dev \
-        zlib1g-dev \
-    && update-ca-certificates \
-    && curl -fsSL "https://github.com/rbenv/ruby-build/archive/refs/tags/${RUBY_BUILD_VERSION}.tar.gz" -o /tmp/ruby-build.tar.gz \
-    && mkdir -p /tmp/ruby-build \
-    && tar -xzf /tmp/ruby-build.tar.gz --strip-components=1 -C /tmp/ruby-build \
-    && /tmp/ruby-build/install.sh \
-    && rm -rf /tmp/ruby-build /tmp/ruby-build.tar.gz /var/lib/apt/lists/*
-
-COPY install-ruby-toolcache.sh /usr/local/bin/install-ruby-toolcache.sh
-
-RUN chmod +x /usr/local/bin/install-ruby-toolcache.sh \
-    && RUBY_VERSION="${RUBY_VERSION}" RUBY_MINOR="${RUBY_MINOR}" TOOLCACHE_ROOT="${RUNNER_RUBY_TOOLCACHE}" RUNNER_UID="${RUNNER_UID}" RUNNER_GID="${RUNNER_GID}" /usr/local/bin/install-ruby-toolcache.sh \
-    && ruby -v
--- a/apps/github-runner/README.md
+++ b/apps/github-runner/README.md
@@ -7,71 +7,17 @@ Deployments with `kubectl`; update this manifest and let ArgoCD reconcile.

 All repo-scoped Linux runners use:

- `localhost/fc-github-runner:v20260525-ruby3.3.11-stepca`, derived from
-  `myoung34/github-runner:latest`
 - `ACCESS_TOKEN` from the `github-runner-token` Secret
 - `RUN_AS_ROOT=false`
 - `EPHEMERAL=true`
 - `LABELS=self-hosted,linux,fc-build-linux`
 - writable non-root paths under `/home/runner` for .NET, NuGet, XDG cache, and
  Actions tool cache
- Ruby 3.3.11 seeded into `/home/runner/_tool/Ruby/3.3/x64` from the baked
-  `/opt/runner-toolcache` copy so `ruby/setup-ruby@v1` can discover it on
-  self-hosted `ubuntu-20.04-x64` runners

 `github-runner` for `FlowerCore.Common` is single-replica because it retains the
-original Longhorn ReadWriteOnce NuGet PVC. Every other repo-scoped runner uses
-two replicas with per-pod `emptyDir` caches. That is the safe backlog-drain
-strategy: no two pods share one RWO PVC.
-
-Sprint 32 final long-tail wave adds 16 two-replica Deployments:
-`FlowerCore.Knowledge`, `FlowerCore.LlmBridge`, `FlowerCore.Media`,
-`FlowerCore.Presentations`, `FlowerCore.RemoteDesktop`, `FlowerCore.DNS`,
-`FlowerCore.Distribution`, `FlowerCore.Scoreboard`,
-`FlowerCore.SegmentDisplay`, `FlowerCore.Signage.Contracts`,
-`FlowerCore.SignalControl`, `FlowerCore.Intranet.Web`,
-`FlowerCore.Provisioning`, `FlowerCore.Redis`, `FlowerCore.MessageBoard`, and
-`FlowerCore.MenuBoard`.
-
-## Image Build
-
-Ruby is baked with a pinned `ruby-build` release and Ruby patch version. The pod
-still mounts an `emptyDir` over `/home/runner`, so the `setup-runner-home` init
-container copies the baked toolcache from `/opt/runner-toolcache/Ruby` into
-`/home/runner/_tool/Ruby` before the runner container starts.
-
-The IAmWorkin step-ca root CA is also baked into the system trust store
-(`/usr/local/share/ca-certificates/iamworkin-step-ca-root.crt`, registered by
-`update-ca-certificates`). Without it, .NET HttpClient calls from CI tests
-against `*.iamworkin.lan` (e.g. `https://selenium.iamworkin.lan/session`)
-fail with `PartialChain`. To refresh the bundled cert when the root rotates,
-re-extract from the cluster and overwrite `step-ca-root.crt`:
-
-```bash
-kubectl get secret -n cert-manager step-ca-root \
-  -o jsonpath='{.data.ca\.crt}' | base64 -d > step-ca-root.crt
-```
-
-```bash
-cd apps/github-runner
-podman build -t localhost/fc-github-runner:v20260525-ruby3.3.11-stepca .
-podman run --rm localhost/fc-github-runner:v20260525-ruby3.3.11-stepca ruby -v
-podman run --rm localhost/fc-github-runner:v20260525-ruby3.3.11-stepca \
-  test -f /opt/runner-toolcache/Ruby/3.3/x64.complete
-podman save localhost/fc-github-runner:v20260525-ruby3.3.11-stepca \
-  -o fc-github-runner-v20260525-ruby3.3.11-stepca.tar
-```
-
-Import the saved image on every schedulable RKE2 node before ArgoCD rolls the
-Deployments:
-
-```bash
-for node in rke2-server rke2-agent1 rke2-agent2; do
-  scp fc-github-runner-v20260525-ruby3.3.11-stepca.tar "$node:/tmp/"
-  ssh "$node" 'sudo ctr -a /run/k3s/containerd/containerd.sock -n k8s.io images rm localhost/fc-github-runner:v20260525-ruby3.3.11-stepca || true'
-  ssh "$node" 'sudo ctr -a /run/k3s/containerd/containerd.sock -n k8s.io images import /tmp/fc-github-runner-v20260525-ruby3.3.11-stepca.tar'
-done
-```
+original Longhorn ReadWriteOnce NuGet PVC. `github-runner-sharedpos` and the top
+Linux-cost repo runners use two replicas with per-pod `emptyDir` caches. That is
+the safe backlog-drain strategy: no two pods share one RWO PVC.

 ## Post-Merge Proof

@@ -81,26 +27,12 @@ After the PR is merged and ArgoCD syncs, verify the runner fleet:
 kubectl -n github-runner get deploy,pods,pvc
 ```

-Verify the Ruby toolcache in a fresh pod:
-
-```bash
-kubectl -n github-runner exec deploy/github-runner-puppet -c runner -- ruby -v
-kubectl -n github-runner exec deploy/github-runner-puppet -c runner -- sh -c \
-  'echo "$RUNNER_TOOL_CACHE" && test -f "$RUNNER_TOOL_CACHE/Ruby/3.3/x64.complete"'
-```
-
 Verify GitHub registration for the repo-scoped runners:

 ```bash
 for repo in FlowerCore.Common FlowerCore.Shared.Pos FlowerCore.Puppet FlowerCore.Signage \
            FlowerCore.DMS FlowerCore.Telephony FlowerCore.Print.Web FlowerCore.Chat \
-            FlowerCore.MySQL FlowerCore.Kiosk.Linux FlowerCore.Marquee FlowerCore.TtsReader \
-            FlowerCore.Knowledge FlowerCore.LlmBridge FlowerCore.Media \
-            FlowerCore.Presentations FlowerCore.RemoteDesktop FlowerCore.DNS \
-            FlowerCore.Distribution FlowerCore.Scoreboard FlowerCore.SegmentDisplay \
-            FlowerCore.Signage.Contracts FlowerCore.SignalControl FlowerCore.Intranet.Web \
-            FlowerCore.Provisioning FlowerCore.Redis FlowerCore.MessageBoard \
-            FlowerCore.MenuBoard; do
+            FlowerCore.MySQL FlowerCore.Kiosk.Linux; do
  echo "=== $repo ==="
  gh api "/repos/astoltz/$repo/actions/runners" \
    --jq '.runners[] | select(.labels[].name == "fc-build-linux") | {name,status,busy,labels:[.labels[].name]}'
@@ -122,10 +54,6 @@ from GitHub Actions and verify it lands on an `rke2-linux-*` runner.
 - `actions/setup-dotnet` permission error at `/usr/share/dotnet`: check that
  `DOTNET_INSTALL_DIR=/home/runner/.dotnet` and related cache env vars are
  present on the runner pod.
- `ruby/setup-ruby@v1` says self-hosted runners must install Ruby in
-  `$RUNNER_TOOL_CACHE`: check that the init container copied
-  `/opt/runner-toolcache/Ruby` into `/home/runner/_tool/Ruby` and that
-  `/home/runner/_tool/Ruby/3.3/x64.complete` exists.
 - `404` during runner registration: the fine-grained PAT is valid but missing
  repository access for that repo. Add the repo to the PAT access list; the PAT
  value does not change.
--- a/apps/github-runner/github-runner.yaml
+++ b/apps/github-runner/github-runner.yaml
--- a/apps/github-runner/install-ruby-toolcache.sh
+++ b/apps/github-runner/install-ruby-toolcache.sh
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-RUBY_VERSION="${RUBY_VERSION:-3.3.11}"
-RUBY_MINOR="${RUBY_MINOR:-3.3}"
-TOOLCACHE_ROOT="${TOOLCACHE_ROOT:-/opt/runner-toolcache}"
-RUNNER_UID="${RUNNER_UID:-1001}"
-RUNNER_GID="${RUNNER_GID:-1001}"
-RUBY_PREFIX="${TOOLCACHE_ROOT}/Ruby/${RUBY_VERSION}/x64"
-
-mkdir -p "${TOOLCACHE_ROOT}/Ruby"
-RUBY_CONFIGURE_OPTS="${RUBY_CONFIGURE_OPTS:---disable-install-doc --disable-yjit}" ruby-build "${RUBY_VERSION}" "${RUBY_PREFIX}"
-
-touch "${TOOLCACHE_ROOT}/Ruby/${RUBY_VERSION}/x64.complete"
-ln -sfn "${RUBY_VERSION}" "${TOOLCACHE_ROOT}/Ruby/${RUBY_MINOR}"
-
-"${RUBY_PREFIX}/bin/ruby" -v
-chown -R "${RUNNER_UID}:${RUNNER_GID}" "${TOOLCACHE_ROOT}"
-chmod -R a+rX "${TOOLCACHE_ROOT}"
--- a/apps/github-runner/step-ca-root.crt
+++ b/apps/github-runner/step-ca-root.crt
@@ -1,12 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIBxDCCAWqgAwIBAgIRAPY357G6ow6zMAL5+4bS2kkwCgYIKoZIzj0EAwIwQDEa
-MBgGA1UEChMRSUFtV29ya2luIEFDTUUgQ0ExIjAgBgNVBAMTGUlBbVdvcmtpbiBB
-Q01FIENBIFJvb3QgQ0EwHhcNMjYwMzA4MTgwNzExWhcNMzYwMzA1MTgwNzExWjBA
-MRowGAYDVQQKExFJQW1Xb3JraW4gQUNNRSBDQTEiMCAGA1UEAxMZSUFtV29ya2lu
-IEFDTUUgQ0EgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJ2n04X1
-JZo5Zdq/i1Idv8+fqwZyAzBh7whbqj0SWsJL8UWRabCMqYCs7+dXO0xRSzqkwFDL
-x+vooOai8RgRNhajRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
-AgEBMB0GA1UdDgQWBBRnuPPQR6iM/H6vOluiU3Sygayz8jAKBggqhkjOPQQDAgNI
-ADBFAiEArQK9dYPGmAZsdYnjziuFVVE5NKZUcceYvGfGC+tLXUsCIAudF2zJrCRq
-3mK50ZZET/fwTkJwiEF4824mjP8p1CKM
-----END CERTIFICATE-----
--- a/apps/intranet/intranet.yaml
+++ b/apps/intranet/intranet.yaml
@@ -46,7 +46,7 @@ spec:
    spec:
      containers:
        - name: intranet-web
-          image: localhost/fc-intranet-web:v20260531-ttsreader-bridge
+          image: localhost/fc-intranet-web:v20260508-brochure-w1
          imagePullPolicy: Never
          ports:
            - containerPort: 5300
--- a/apps/knowledge/knowledge.yaml
+++ b/apps/knowledge/knowledge.yaml
@@ -51,14 +51,6 @@ metadata:
 spec:
  itemPath: "vaults/IAmWorkin/items/FlowerCore Knowledge MCP Tokens"
 ---
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: knowledge-oidc-client
-  namespace: knowledge
-spec:
-  itemPath: "vaults/IAmWorkin/items/knowledge-oidc-client"
---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -110,7 +102,7 @@ spec:
        - name: web
          # Placeholder tag — bump to the image you built + imported to ALL
          # RKE2 nodes via scripts/deploy-knowledge.sh before applying.
-          image: localhost/fc-knowledge-web:v20260603-oidc-authentik-auditfix
+          image: localhost/fc-knowledge-web:v20260429232635
          imagePullPolicy: Never
          command:
            - /bin/sh
@@ -131,38 +123,6 @@ spec:
              value: "Production"
            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
              value: "false"
-            # AuthentiK/OIDC is wired but not enforced until the
-            # knowledge-oidc-client Secret is provisioned. Service-to-service
-            # RAG keeps the existing MCP token as FlowerCore:Auth:ApiKey.
-            - name: FlowerCore__Auth__Enabled
-              value: "true"
-            - name: FlowerCore__Auth__Oidc__Enabled
-              value: "true"
-            - name: FlowerCore__Auth__Oidc__Authority
-              valueFrom:
-                secretKeyRef:
-                  name: knowledge-oidc-client
-                  key: issuer_url
-                  optional: true
-            - name: FlowerCore__Auth__Oidc__Audience
-              value: "knowledge"
-            - name: FlowerCore__Auth__Oidc__ClientId
-              valueFrom:
-                secretKeyRef:
-                  name: knowledge-oidc-client
-                  key: client_id
-                  optional: true
-            - name: FlowerCore__Auth__Oidc__ClientSecret
-              valueFrom:
-                secretKeyRef:
-                  name: knowledge-oidc-client
-                  key: client_secret
-                  optional: true
-            - name: FlowerCore__Auth__ApiKey
-              valueFrom:
-                secretKeyRef:
-                  name: knowledge-mcp-tokens
-                  key: password
            # Vector-store directory + embedding model + edition profile dir.
            # Profile JSON is baked into the image at /home/app/editions via the
            # csproj Content-link from FlowerCore.Common/editions/.
@@ -174,8 +134,6 @@ spec:
              value: "5"
            - name: Knowledge__MaxLimit
              value: "50"
-            - name: Knowledge__Federation__DatabasePath
-              value: "/data/vector-stores/knowledge-federation.db"
            - name: FlowerCore__Editions__ProfileDirectory
              value: "/home/app/editions"
            # Embed via edge1 Pi 5 + AI HAT+ (10.0.57.17:11434). Cluster
--- a/apps/kubevirt-vms/ci1.yaml
+++ b/apps/kubevirt-vms/ci1.yaml
@@ -25,7 +25,7 @@ metadata:
    role: github-actions-runner
    flowercore.io/managed-by: bluejay-infra
 spec:
-  runStrategy: Halted
+  runStrategy: Always
  template:
    metadata:
      labels:
--- a/apps/mail/mail.yaml
+++ b/apps/mail/mail.yaml
@@ -207,13 +207,20 @@ spec:
    - port: 993
      targetPort: 993
      name: imaps
-# --- mail-tls Certificate REMOVED 2026-06-01 ---
-# mail-tls is now managed OUTSIDE cert-manager: issued from step-ca's JWK 'admin'
-# provisioner and auto-renewed by a systemd timer on noc1 (step ca renew), which
-# writes the mail-tls secret directly. step-ca-acme only has an HTTP-01 (Traefik)
-# solver, but mail.iamworkin.lan must resolve to the dedicated MetalLB IP 10.0.56.202
-# (SMTP/IMAP), so HTTP-01 cannot validate. Do NOT re-add a cert-manager Certificate
-# here unless a DNS-01 solver is deployed for step-ca-acme.
+---
+# TLS Certificate via cert-manager
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mail-tls
+  namespace: mail
+spec:
+  secretName: mail-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - mail.iamworkin.lan
 ---
 # Traefik IngressRoute - Webmail placeholder
 apiVersion: traefik.io/v1alpha1
--- a/apps/monitoring/noc-monitoring.yaml
+++ b/apps/monitoring/noc-monitoring.yaml
@@ -223,7 +223,7 @@ data:
              service: "pimanager"
              vlan: "home"
              device: "pi4-ezconnect"
-          - targets: ["10.0.58.113:5200"]
+          - targets: ["10.0.58.113:5100"]
            labels:
              instance: "pirelay"
              service: "pimanager"
@@ -280,14 +280,13 @@ data:
              printer_model: "NuPrint 210"

      # Print.Web health (Blazor app on edge2:5200)
-      # Target `/health` (anonymous) — root path requires API key auth and returns 401.
      - job_name: "probe-printweb"
        metrics_path: /probe
        params:
          module: [http_2xx]
        scrape_interval: 30s
        static_configs:
-          - targets: ["http://10.0.57.16:5200/health"]
+          - targets: ["http://10.0.57.16:5200/"]
            labels:
              instance: "print-web"
              service: "print-web"
@@ -479,11 +478,11 @@ data:
              - "https://gitea.iamworkin.lan/"
              - "https://argocd.iamworkin.lan/"
              - "https://intranet.iamworkin.lan/"
-              - "https://signage.iamworkin.lan/healthz"   # root 401 auth-gated 2026-06-01; /healthz anon 200
+              - "https://signage.iamworkin.lan/"
              - "https://kiosk.iamworkin.lan/"
              - "https://media.iamworkin.lan/"
-              - "https://mysql.iamworkin.lan/healthz"   # root 401 auth-gated 2026-06-01; /healthz anon 200
-              - "https://php.iamworkin.lan/healthz"     # root 401 auth-gated 2026-06-01; /healthz anon 200
+              - "https://mysql.iamworkin.lan/"
+              - "https://php.iamworkin.lan/"
              - "https://zabbix.iamworkin.lan/"
              - "https://desktop.iamworkin.lan/"
              - "https://print.iamworkin.lan/"
@@ -967,52 +966,6 @@ data:
            annotations:
              summary: "Disk usage high on {{ $labels.instance }} ({{ $value | printf \"%.1f\" }}%)"

-      # Puppet agent + service alerts.
-      # Mirror of FlowerCore.Notes/scripts/monitoring/alerts.yml `puppet` group
-      # so a future migration to in-cluster Prometheus inherits the ruleset.
-      # Source-of-truth for the live Podman Prometheus on noc1 is the Notes file.
-      # See feedback_monitoring_k8s_target_vs_live_podman.
-      - name: puppet
-        rules:
-          - alert: PuppetAgentReportStale
-            expr: puppet_last_run_age_seconds > 7200
-            for: 30m
-            labels:
-              severity: warning
-              alert_channel: irc
-            annotations:
-              summary: "Puppet agent {{ $labels.instance }} hasn't reported in over 2h"
-              description: "Last run age: {{ $value | humanizeDuration }}. The puppet agent on {{ $labels.instance }} may be stopped, the node may be powered off, or noc1 may be unreachable from this node."
-              runbook: "1. SSH to node (via noc1 jumpbox if needed) 2. sudo systemctl status puppet 3. sudo puppet agent -t --noop to force a run 4. Check r10k: ssh fcadmin@10.0.56.10 'sudo podman logs openvoxserver --tail 50' 5. Verify noc1 reachability: ping puppet.iamworkin.lan"
-
-          - alert: PuppetAgentReportCritical
-            expr: puppet_last_run_age_seconds > 86400
-            for: 1h
-            labels:
-              severity: critical
-              alert_channel: irc
-            annotations:
-              summary: "Puppet agent {{ $labels.instance }} silent for over 24h — node is unmanaged"
-              description: "Last run age: {{ $value | humanizeDuration }}. Node {{ $labels.instance }} has not submitted a Puppet report in over 24 hours. Config drift is accumulating — investigate immediately. If intentional (maintenance), add to the exclusion filter or silence in Grafana."
-              runbook: "URGENT: 1. Check node power state 2. SSH via noc1 jumpbox: ssh fcadmin@10.0.56.10 then ssh <node> 3. sudo systemctl status puppet 4. sudo systemctl start puppet + sudo puppet agent -t 5. Check for network partitions (VLAN connectivity to 10.0.56.10) 6. If node was recently reimaged: sudo puppet agent -t to re-register with new SSL cert"
-
-          # Sprint 33 Cx-7 Phase B (2026-05-25 postmortem follow-up):
-          # Detects puppet.service in failed state — distinct from PuppetAgentReportStale
-          # which catches "agent hasn't run." This catches "systemd gave up restarting it"
-          # (CA-verify loop or other fatal exit). Requires node-exporter systemd collector
-          # enabled with --collector.systemd. If `node_systemd_unit_state` has no series
-          # for a node, the collector is disabled there — flag in postmortem follow-up.
-          - alert: PuppetServiceFailed
-            expr: node_systemd_unit_state{name="puppet.service",state="failed"} == 1
-            for: 5m
-            labels:
-              severity: warning
-              alert_channel: irc
-            annotations:
-              summary: "Puppet service failed on {{ $labels.instance }}"
-              description: "puppet.service on {{ $labels.instance }} has been in failed state for 5+ minutes. systemd has stopped auto-restarting (CA-verify-loop or other exit). Manual `systemctl status puppet` confirms. Run `sudo systemctl start puppet` to recover; investigate journal for root cause."
-              runbook_url: "https://github.com/astoltz/FlowerCore.Notes/blob/master/memory/feedback_puppet_service_dead_after_ca_loop_alert_misreads.md"
-
      # K8s pod-state alerts. Require kube-state-metrics scrape (added
      # 2026-04-26 — see scrape_configs above). Would have surfaced the
      # agent-zero ollama-proxy 172x crash-loop instead of letting it
@@ -1274,55 +1227,24 @@ metadata:
 data:
  notify.py: |
    #!/usr/bin/env python3
-    """HTTP->IRC alert relay with thermal-printer DIGEST forwarding.
-
-    Listens on :9119, posts to #alerts on UnrealIRCd, forwards to Print.Web
-    /api/print/alert. Thermal printing is BATCHED into hourly digests by
-    default so the printer no longer spam-fires per Grafana webhook.
-
-    Routing (per Grafana webhook alert):
-      - IRC: always per-event (operator likes the stream)
-      - Thermal printer:
-          * severity in {critical,disaster,page} OR
-            label alert_channel=thermal_print_immediate -> print NOW
-          * label alert_channel=thermal_print -> enqueue into hourly digest
-          * everything else -> IRC only
-      - RESOLVED webhooks remove the alert from the digest buffer
-
-    Env vars (defaults preserve old behavior on first deploy):
-      THERMAL_PRINT_ENABLED  default "true"   - master kill switch
-      BATCH_INTERVAL_MIN     default "60"     - minutes between digest prints
-      BATCH_MAX_PENDING      default "50"     - force-flush threshold
-
-    HTTP surface:
-      POST /         - Grafana webhook entry
-      POST /flush    - manual digest flush (idempotent)
-      GET  /         - status + config + buffer depth + stats
+    """HTTP->IRC alert relay with thermal printer forwarding for Grafana webhooks.
+    Listens on :9119, posts to #alerts on UnrealIRCd via raw IRC protocol.
+    Alerts tagged alert_channel=thermal_print also POST to Print.Web /api/print/alert.
    """
-    import json, os, socket, sys, threading, time
-    from collections import defaultdict
-    from datetime import datetime, timezone
+    import json, socket, sys, time
    from http.server import HTTPServer, BaseHTTPRequestHandler
    from urllib.request import Request, urlopen
+    from urllib.error import URLError

-    THERMAL_PRINT_ENABLED = os.environ.get("THERMAL_PRINT_ENABLED", "true").lower() == "true"
-    BATCH_INTERVAL_MIN    = int(os.environ.get("BATCH_INTERVAL_MIN", "60"))
-    BATCH_MAX_PENDING     = int(os.environ.get("BATCH_MAX_PENDING", "50"))
-
-    IRC_HOST      = os.environ.get("IRC_HOST", "unrealircd.irc.svc")
-    IRC_PORT      = int(os.environ.get("IRC_PORT", "6667"))
-    IRC_NICK      = os.environ.get("IRC_NICK", "grafana-bot")
-    IRC_CHANNEL   = os.environ.get("IRC_CHANNEL", "#alerts")
-    PRINT_WEB_URL = os.environ.get("PRINT_WEB_URL", "http://10.0.57.16:5200/api/print/alert")
-
-    _buffer_lock = threading.Lock()
-    _buffer = {}   # fingerprint -> {"alert": dict, "first_seen": float, "last_seen": float}
-    _last_flush_time = time.time()
-    _stats = {"webhooks_received": 0, "irc_sent": 0, "print_immediate": 0,
-              "digest_flushed": 0, "buffer_dedup": 0, "buffer_added": 0,
-              "buffer_resolved": 0, "started_at": time.time()}
+    IRC_HOST = "unrealircd.irc.svc"  # short name: CoreDNS ndots:5 + iamworkin.lan template hijacks full .cluster.local (see memory)
+    IRC_PORT = 6667
+    IRC_NICK = "grafana-bot"
+    IRC_CHANNEL = "#alerts"
+    PRINT_WEB_URL = "http://10.0.57.16:5200/api/print/alert"
+    PRINT_ENABLED = True

    def send_irc(message):
+        """Connect, handle PING, join, send, quit."""
        try:
            sock = socket.create_connection((IRC_HOST, IRC_PORT), timeout=15)
            sock.sendall(f"NICK {IRC_NICK}\r\n".encode())
@@ -1355,137 +1277,52 @@ data:
            time.sleep(0.5)
            sock.sendall(b"QUIT :alert delivered\r\n")
            sock.close()
-            _stats["irc_sent"] += 1
            return True
        except Exception as e:
            print(f"[irc-notify] IRC send failed: {e}", file=sys.stderr)
            return False

-    def post_thermal(payload, kind):
-        if not THERMAL_PRINT_ENABLED:
-            print(f"[irc-notify] thermal disabled; skip {kind} ({payload.get('title','?')[:40]})", file=sys.stderr)
-            return False
+    def send_thermal_print(alert):
+        if not PRINT_ENABLED: return
+        labels = alert.get("labels", {})
+        annotations = alert.get("annotations", {})
+        status = alert.get("status", "firing").upper()
+        summary = annotations.get("summary", "")
+        description = annotations.get("description", "")
+        runbook = annotations.get("runbook", "")
+        # Build a useful message: summary + description + runbook steps
+        parts = []
+        if summary: parts.append(summary)
+        if description and description != summary: parts.append(description)
+        if runbook: parts.append("STEPS: " + runbook)
+        message = " | ".join(parts) if parts else labels.get("alertname", "Unknown alert")
+        payload = {
+            "title": labels.get("alertname", "Unknown"),
+            "severity": labels.get("severity", "warning").capitalize(),
+            "host": labels.get("instance", labels.get("host", "unknown")),
+            "message": message,
+            "eventId": alert.get("fingerprint", ""),
+            "source": "Grafana",
+            "status": "RESOLVED" if status == "RESOLVED" else "PROBLEM",
+            "acknowledged": False
+        }
        try:
            req = Request(PRINT_WEB_URL, data=json.dumps(payload).encode("utf-8"),
                          headers={"Content-Type": "application/json"}, method="POST")
            resp = urlopen(req, timeout=10)
-            if kind == "immediate": _stats["print_immediate"] += 1
-            print(f"[irc-notify] thermal {kind} sent: {payload.get('title','?')[:50]}", file=sys.stderr)
-            return True
+            print(f"[irc-notify] Thermal print sent: {resp.read().decode()}", file=sys.stderr)
        except Exception as e:
-            print(f"[irc-notify] thermal {kind} failed: {e}", file=sys.stderr)
-            return False
+            print(f"[irc-notify] Thermal print failed: {e}", file=sys.stderr)

-    def fingerprint_of(alert):
-        fp = alert.get("fingerprint", "")
-        if fp: return fp
+    def should_print(alert):
        labels = alert.get("labels", {})
-        target = labels.get("pod") or labels.get("instance") or labels.get("deployment") or labels.get("statefulset") or labels.get("namespace") or ""
-        return f"{labels.get('alertname','?')}/{labels.get('namespace','')}/{target}"
-
-    def is_critical(alert):
-        return alert.get("labels", {}).get("severity", "").lower() in ("critical", "disaster", "page")
-
-    def is_immediate_label(alert):
-        return alert.get("labels", {}).get("alert_channel") == "thermal_print_immediate"
-
-    def is_batched_label(alert):
-        return alert.get("labels", {}).get("alert_channel") == "thermal_print"
-
-    def add_to_digest(alert):
-        """Add an alert to the digest buffer. Returns True if the buffer GREW
-        (new fingerprint), False if it was a dedup, resolution, or no-op.
-        """
-        if not THERMAL_PRINT_ENABLED: return False
-        fp = fingerprint_of(alert)
-        status = alert.get("status", "firing").lower()
-        with _buffer_lock:
-            if status == "resolved":
-                if fp in _buffer:
-                    del _buffer[fp]
-                    _stats["buffer_resolved"] += 1
-                return False
-            if fp in _buffer:
-                _buffer[fp]["last_seen"] = time.time()
-                _buffer[fp]["alert"] = alert
-                _stats["buffer_dedup"] += 1
-                return False
-            _buffer[fp] = {"alert": alert, "first_seen": time.time(), "last_seen": time.time()}
-            _stats["buffer_added"] += 1
-            return True
-
-    def build_digest_payload():
-        with _buffer_lock:
-            items = list(_buffer.values())
-        if not items: return None
-        by_name = defaultdict(list)
-        for item in items:
-            labels = item["alert"].get("labels", {})
-            by_name[labels.get("alertname", "Unknown")].append(item)
-        lines = []
-        for name, group in sorted(by_name.items()):
-            targets = []
-            for it in group[:5]:
-                labels = it["alert"].get("labels", {})
-                t = (labels.get("pod") or labels.get("instance") or labels.get("deployment")
-                     or labels.get("statefulset") or labels.get("namespace") or "?")
-                targets.append(t)
-            more = f" (+{len(group)-5})" if len(group) > 5 else ""
-            sevs = sorted({it["alert"].get("labels", {}).get("severity", "warning") for it in group})
-            lines.append(f"[{'/'.join(sevs)}] {name} x{len(group)}: {', '.join(targets)}{more}")
-        now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
-        title = f"Alert digest: {len(items)} firing"
-        body = "\n".join([
-            f"=== {title} ===",
-            f"as of {now}",
-            "",
-            *lines,
-            "",
-            "Stream: #alerts (IRC)  |  Triage: grafana-noc1.iamworkin.lan",
-            "Force-flush: POST irc-notify.monitoring.svc:9119/flush",
-        ])
-        return {"title": title, "severity": "Warning", "host": "monitoring",
-                "message": body, "eventId": f"digest-{int(time.time())}",
-                "source": "Grafana digest", "status": "PROBLEM", "acknowledged": False}
-
-    def flush_digest():
-        payload = build_digest_payload()
-        if payload is None:
-            print("[irc-notify] flush: buffer empty, no digest sent", file=sys.stderr)
-            return False
-        sent = post_thermal(payload, "digest")
-        with _buffer_lock:
-            _buffer.clear()
-        if sent: _stats["digest_flushed"] += 1
-        return sent
-
-    def digest_loop():
-        global _last_flush_time
-        while True:
-            try:
-                now = time.time()
-                elapsed = now - _last_flush_time
-                if elapsed >= BATCH_INTERVAL_MIN * 60:
-                    print(f"[irc-notify] digest tick: interval reached ({BATCH_INTERVAL_MIN}m); buffer={len(_buffer)}", file=sys.stderr)
-                    flush_digest()
-                    _last_flush_time = now
-                elif len(_buffer) >= BATCH_MAX_PENDING:
-                    print(f"[irc-notify] digest tick: buffer full ({len(_buffer)}); force flush", file=sys.stderr)
-                    flush_digest()
-                    _last_flush_time = now
-                time.sleep(15)
-            except Exception as e:
-                print(f"[irc-notify] digest loop error: {e}", file=sys.stderr)
-                time.sleep(60)
+        if labels.get("alert_channel") == "thermal_print": return True
+        if labels.get("severity", "").lower() in ("critical", "disaster"): return True
+        if alert.get("status", "").upper() == "RESOLVED": return False
+        return False

    class Handler(BaseHTTPRequestHandler):
        def do_POST(self):
-            if self.path == "/flush":
-                ok = flush_digest()
-                self.send_response(200); self.send_header("Content-Type", "application/json"); self.end_headers()
-                self.wfile.write(json.dumps({"flushed": ok, "buffer_after": len(_buffer)}).encode())
-                return
-            _stats["webhooks_received"] += 1
            length = int(self.headers.get("Content-Length", 0))
            body = json.loads(self.rfile.read(length)) if length else {}
            for alert in body.get("alerts", []):
@@ -1500,56 +1337,22 @@ data:
                msg = f"{icon}{sev_tag} {name}: {summary}"
                if desc: msg += f"\n  {desc}"
                send_irc(msg)
-                # Thermal routing — EVERYTHING (including criticals) goes into
-                # the hourly digest. Only the explicit `alert_channel=thermal_print_immediate`
-                # label bypasses, and even that flushes-the-current-digest rather
-                # than printing a standalone job, so the same fingerprint can't
-                # spam the printer per webhook cycle.
-                if status == "RESOLVED":
-                    add_to_digest(alert)  # removes from buffer
-                    continue
-                if is_immediate_label(alert):
-                    # Explicit opt-in for "paper this NOW" — first arrival of a
-                    # new fingerprint triggers an immediate digest flush; repeat
-                    # webhooks for the same fingerprint dedupe in the buffer
-                    # until the next interval or until the alert resolves.
-                    new_in_buffer = add_to_digest(alert)
-                    if new_in_buffer:
-                        global _last_flush_time
-                        flush_digest()
-                        _last_flush_time = time.time()
-                elif is_critical(alert) or is_batched_label(alert):
-                    add_to_digest(alert)
-                # else: IRC-only (warnings without thermal_print label)
-            self.send_response(200); self.send_header("Content-Type", "application/json"); self.end_headers()
+                if should_print(alert): send_thermal_print(alert)
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
            self.wfile.write(b'{"status":"ok"}')
-
        def do_GET(self):
-            self.send_response(200); self.send_header("Content-Type", "application/json"); self.end_headers()
-            with _buffer_lock:
-                alertnames = sorted({it["alert"].get("labels", {}).get("alertname", "?") for it in _buffer.values()})
-                depth = len(_buffer)
-            info = {
-                "service": "irc-notify",
-                "config": {"thermal_print_enabled": THERMAL_PRINT_ENABLED,
-                           "batch_interval_min": BATCH_INTERVAL_MIN,
-                           "batch_max_pending": BATCH_MAX_PENDING,
-                           "irc_target": f"{IRC_HOST}:{IRC_PORT} {IRC_CHANNEL}",
-                           "print_web_url": PRINT_WEB_URL},
-                "buffer": {"depth": depth, "alertnames": alertnames,
-                           "seconds_since_last_flush": int(time.time() - _last_flush_time),
-                           "seconds_until_next_flush": max(0, int(BATCH_INTERVAL_MIN*60 - (time.time() - _last_flush_time)))},
-                "stats": _stats,
-            }
-            self.wfile.write(json.dumps(info, indent=2).encode())
-
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(json.dumps({"service":"irc-notify","thermal_print":PRINT_ENABLED}).encode())
        def log_message(self, format, *args):
            print(f"[irc-notify] {args[0]}", file=sys.stderr)

    if __name__ == "__main__":
-        threading.Thread(target=digest_loop, daemon=True).start()
        server = HTTPServer(("0.0.0.0", 9119), Handler)
-        print(f"[irc-notify] :9119 -> IRC {IRC_HOST}:{IRC_PORT} {IRC_CHANNEL} | thermal={'ON' if THERMAL_PRINT_ENABLED else 'OFF'} | digest={BATCH_INTERVAL_MIN}m max={BATCH_MAX_PENDING}", file=sys.stderr)
+        print(f"IRC alert relay :9119 -> {IRC_HOST}:{IRC_PORT} {IRC_CHANNEL} (thermal: {PRINT_ENABLED})")
        server.serve_forever()

 # =============================================================================
--- a/apps/selenium/network-policy.yaml
+++ b/apps/selenium/network-policy.yaml
@@ -24,16 +24,7 @@
 #     (10.0.57.16:5200), public internet 80/443 (excluding RFC1918), and
 #     fc-signage:5190 for the signage AAT lane.
 #   - Ingress: Traefik (4444 + 8089 ACME-solver-style), intra-pod,
-#     telephony / gitea / fc-system / fc-signage / github-runner namespaces
-#     on 4444.
-#
-# 2026-05-25: added github-runner ingress on 4444 so CI jobs running in
-# self-hosted runner pods (e.g. FlowerCore.Print.Web `help-screenshots`)
-# can reach the grid. Without this allow, the session POST to
-# `selenium-hub.selenium.svc.cluster.local:4444` was DNAT'd to the hub
-# pod IP and then dropped at the Calico ingress hook — Selenium UI showed
-# 0/4 sessions while the .NET HTTP client timed out at 60s. Same family
-# as `feedback_netpol_dnat_backend_port`, wrong-source-namespace flavor.
+#     telephony / gitea / fc-system / fc-signage namespaces on 4444.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -212,13 +203,6 @@ spec:
    ports:
    - port: 4444
      protocol: TCP
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: github-runner
-    ports:
-    - port: 4444
-      protocol: TCP
  podSelector: {}
  policyTypes:
  - Ingress
--- a/apps/selenium/selenium-grid.yaml
+++ b/apps/selenium/selenium-grid.yaml
@@ -1,427 +0,0 @@
-# Selenium Grid 4 — RKE2 deployment
-#
-# Hub + chrome + firefox + edge browser nodes serving fleet-wide AAT runs from
-# the GitHub Actions self-hosted runners. ArgoCD owns this namespace from
-# 2026-05-25 (`infra-selenium` Application; previously these resources were
-# orphan kubectl-applied since 2026-03-15).
-#
-# Endpoints:
-#   - Internal cluster: http://selenium-hub.selenium.svc.cluster.local:4444
-#   - LAN LoadBalancer (MetalLB): http://10.0.56.208:4444
-#   - Traefik public: https://selenium.iamworkin.lan
-#
-# Browser maxSessions:
-#   - chrome 2  (bumped from 1 on 2026-05-25 morning-routine — AAT-heavy
-#                Print.Web help-screenshots was the global bottleneck;
-#                see commit history for ops/runner-replica-rightsize)
-#   - firefox 1
-#   - edge 1
-#
-# Screenshots + video recording write to NFS via the chrome video sidecar.
-# See: CLAUDE.md "Selenium Grid & Visual AAT Testing" + bluejay-infra ADR notes.
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: selenium-hub
-    app.kubernetes.io/name: selenium-hub
-    app.kubernetes.io/part-of: selenium-grid
-  name: selenium-hub
-  namespace: selenium
-spec:
-  ports:
-  - name: web
-    port: 4444
-    targetPort: 4444
-  - name: publish
-    port: 4442
-    targetPort: 4442
-  - name: subscribe
-    port: 4443
-    targetPort: 4443
-  selector:
-    app: selenium-hub
-  type: ClusterIP
---
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    metallb.io/ip-allocated-from-pool: bluejay-pool
-    metallb.universe.tf/loadBalancerIPs: 10.0.56.208
-  labels:
-    app: selenium-hub
-    component: external-access
-  name: selenium-hub-external
-  namespace: selenium
-spec:
-  clusterIP: 10.43.90.147
-  clusterIPs:
-  - 10.43.90.147
-  externalTrafficPolicy: Local
-  healthCheckNodePort: 32213
-  ports:
-  - name: web
-    nodePort: 32411
-    port: 4444
-    targetPort: 4444
-  - name: publish
-    nodePort: 32068
-    port: 4442
-    targetPort: 4442
-  - name: subscribe
-    nodePort: 31000
-    port: 4443
-    targetPort: 4443
-  selector:
-    app: selenium-hub
-  type: LoadBalancer
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: selenium-hub
-    app.kubernetes.io/name: selenium-hub
-    app.kubernetes.io/part-of: selenium-grid
-  name: selenium-hub
-  namespace: selenium
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: selenium-hub
-  template:
-    metadata:
-      labels:
-        app: selenium-hub
-        app.kubernetes.io/name: selenium-hub
-        app.kubernetes.io/part-of: selenium-grid
-    spec:
-      containers:
-      - env:
-        - name: SE_NODE_SESSION_TIMEOUT
-          value: '300'
-        - name: SE_SESSION_REQUEST_TIMEOUT
-          value: '300'
-        - name: SE_SESSION_RETRY_INTERVAL
-          value: '5'
-        - name: JAVA_OPTS
-          value: -Xmx512m
-        image: selenium/hub:4.27.0
-        livenessProbe:
-          httpGet:
-            path: /wd/hub/status
-            port: 4444
-          initialDelaySeconds: 30
-          periodSeconds: 15
-          timeoutSeconds: 5
-        name: selenium-hub
-        ports:
-        - containerPort: 4444
-          name: web
-        - containerPort: 4442
-          name: publish
-        - containerPort: 4443
-          name: subscribe
-        readinessProbe:
-          httpGet:
-            path: /wd/hub/status
-            port: 4444
-          initialDelaySeconds: 10
-          periodSeconds: 5
-          timeoutSeconds: 5
-        # Hub baseline working set ~766Mi on 2026-05-25 (75% of prior 1Gi
-        # limit). Bump to 1.5Gi / 1Gi to keep ~50% headroom; matches the
-        # stampede-buffer pattern documented for multus
-        # (feedback_k8s_cni_multus_sizing). CPU left alone — observed 54m
-        # against a 500m limit, no contention.
-        resources:
-          limits:
-            cpu: 500m
-            memory: 1536Mi
-          requests:
-            cpu: 250m
-            memory: 1Gi
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: selenium-node-chrome
-    app.kubernetes.io/name: selenium-node-chrome
-    app.kubernetes.io/part-of: selenium-grid
-  name: selenium-node-chrome
-  namespace: selenium
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: selenium-node-chrome
-  template:
-    metadata:
-      labels:
-        app: selenium-node-chrome
-        app.kubernetes.io/name: selenium-node-chrome
-        app.kubernetes.io/part-of: selenium-grid
-    spec:
-      containers:
-      - env:
-        - name: SE_EVENT_BUS_HOST
-          value: selenium-hub
-        - name: SE_EVENT_BUS_PUBLISH_PORT
-          value: '4442'
-        - name: SE_EVENT_BUS_SUBSCRIBE_PORT
-          value: '4443'
-        - name: SE_NODE_MAX_SESSIONS
-          value: '2'
-        - name: SE_NODE_OVERRIDE_MAX_SESSIONS
-          value: 'false'
-        - name: SE_VNC_NO_PASSWORD
-          value: '1'
-        - name: SE_SCREEN_WIDTH
-          value: '1920'
-        - name: SE_SCREEN_HEIGHT
-          value: '1080'
-        - name: SE_NODE_SESSION_TIMEOUT
-          value: '300'
-        image: selenium/node-chrome:4.27.0
-        livenessProbe:
-          httpGet:
-            path: /status
-            port: 5555
-          initialDelaySeconds: 30
-          periodSeconds: 15
-        name: selenium-chrome
-        ports:
-        - containerPort: 5555
-          name: node
-        readinessProbe:
-          httpGet:
-            path: /status
-            port: 5555
-          initialDelaySeconds: 15
-          periodSeconds: 5
-        # Chromium-based browser node. Bumped from 1Gi -> 2Gi (req 512Mi
-        # -> 1Gi) on 2026-05-25 — Edge had 51 OOMKills in 5d on the
-        # original 1Gi cap (~1 OOM every 2.4h), and Chrome at maxSessions=2
-        # was running 684Mi idle on the same cap. Matches the Firefox node's
-        # tested-stable 2Gi limit. CPU unchanged.
-        resources:
-          limits:
-            cpu: '1'
-            memory: 2Gi
-          requests:
-            cpu: 500m
-            memory: 1Gi
-        volumeMounts:
-        - mountPath: /dev/shm
-          name: dshm
-      - env:
-        - name: DISPLAY_CONTAINER_NAME
-          value: localhost
-        - name: SE_SCREEN_WIDTH
-          value: '1920'
-        - name: SE_SCREEN_HEIGHT
-          value: '1080'
-        - name: SE_VIDEO_FILE_NAME
-          value: auto
-        - name: SE_VIDEO_UPLOAD_ENABLED
-          value: 'false'
-        image: selenium/video:ffmpeg-7.1-20250101
-        name: video
-        resources:
-          limits:
-            cpu: 500m
-            memory: 768Mi
-          requests:
-            cpu: 250m
-            memory: 384Mi
-        volumeMounts:
-        - mountPath: /videos
-          name: selenium-videos
-      volumes:
-      - emptyDir:
-          medium: Memory
-          sizeLimit: 2Gi
-        name: dshm
-      - emptyDir:
-          sizeLimit: 5Gi
-        name: selenium-videos
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: selenium-node-firefox
-    app.kubernetes.io/name: selenium-node-firefox
-    app.kubernetes.io/part-of: selenium-grid
-  name: selenium-node-firefox
-  namespace: selenium
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: selenium-node-firefox
-  template:
-    metadata:
-      labels:
-        app: selenium-node-firefox
-        app.kubernetes.io/name: selenium-node-firefox
-        app.kubernetes.io/part-of: selenium-grid
-    spec:
-      containers:
-      - env:
-        - name: SE_EVENT_BUS_HOST
-          value: selenium-hub
-        - name: SE_EVENT_BUS_PUBLISH_PORT
-          value: '4442'
-        - name: SE_EVENT_BUS_SUBSCRIBE_PORT
-          value: '4443'
-        - name: SE_NODE_MAX_SESSIONS
-          value: '1'
-        - name: SE_NODE_OVERRIDE_MAX_SESSIONS
-          value: 'true'
-        - name: SE_VNC_NO_PASSWORD
-          value: '1'
-        - name: SE_START_VNC
-          value: 'false'
-        - name: SE_SCREEN_WIDTH
-          value: '1920'
-        - name: SE_SCREEN_HEIGHT
-          value: '1080'
-        - name: SE_NODE_SESSION_TIMEOUT
-          value: '300'
-        image: selenium/node-firefox:4.27.0
-        livenessProbe:
-          failureThreshold: 5
-          httpGet:
-            path: /status
-            port: 5555
-          initialDelaySeconds: 30
-          periodSeconds: 15
-          timeoutSeconds: 5
-        name: selenium-firefox
-        ports:
-        - containerPort: 5555
-          name: node
-        readinessProbe:
-          failureThreshold: 5
-          httpGet:
-            path: /status
-            port: 5555
-          initialDelaySeconds: 15
-          periodSeconds: 5
-          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: '1'
-            memory: 2Gi
-          requests:
-            cpu: 500m
-            memory: 1Gi
-        volumeMounts:
-        - mountPath: /dev/shm
-          name: dshm
-      volumes:
-      - emptyDir:
-          medium: Memory
-          sizeLimit: 2Gi
-        name: dshm
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: selenium-node-edge
-    app.kubernetes.io/name: selenium-node-edge
-    app.kubernetes.io/part-of: selenium-grid
-  name: selenium-node-edge
-  namespace: selenium
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: selenium-node-edge
-  template:
-    metadata:
-      labels:
-        app: selenium-node-edge
-        app.kubernetes.io/name: selenium-node-edge
-        app.kubernetes.io/part-of: selenium-grid
-    spec:
-      containers:
-      - env:
-        - name: SE_EVENT_BUS_HOST
-          value: selenium-hub
-        - name: SE_EVENT_BUS_PUBLISH_PORT
-          value: '4442'
-        - name: SE_EVENT_BUS_SUBSCRIBE_PORT
-          value: '4443'
-        - name: SE_NODE_MAX_SESSIONS
-          value: '1'
-        - name: SE_NODE_OVERRIDE_MAX_SESSIONS
-          value: 'true'
-        - name: SE_VNC_NO_PASSWORD
-          value: '1'
-        - name: SE_SCREEN_WIDTH
-          value: '1920'
-        - name: SE_SCREEN_HEIGHT
-          value: '1080'
-        - name: SE_NODE_SESSION_TIMEOUT
-          value: '300'
-        image: selenium/node-edge:4.27.0
-        livenessProbe:
-          httpGet:
-            path: /status
-            port: 5555
-          initialDelaySeconds: 30
-          periodSeconds: 15
-        name: selenium-edge
-        ports:
-        - containerPort: 5555
-          name: node
-        readinessProbe:
-          httpGet:
-            path: /status
-            port: 5555
-          initialDelaySeconds: 15
-          periodSeconds: 5
-        # Chromium-based browser node. Bumped from 1Gi -> 2Gi (req 512Mi
-        # -> 1Gi) on 2026-05-25 — Edge had 51 OOMKills in 5d on the
-        # original 1Gi cap (~1 OOM every 2.4h), and Chrome at maxSessions=2
-        # was running 684Mi idle on the same cap. Matches the Firefox node's
-        # tested-stable 2Gi limit. CPU unchanged.
-        resources:
-          limits:
-            cpu: '1'
-            memory: 2Gi
-          requests:
-            cpu: 500m
-            memory: 1Gi
-        volumeMounts:
-        - mountPath: /dev/shm
-          name: dshm
-      volumes:
-      - emptyDir:
-          medium: Memory
-          sizeLimit: 2Gi
-        name: dshm
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: selenium-hub
-  namespace: selenium
-spec:
-  entryPoints:
-  - websecure
-  routes:
-  - kind: Rule
-    match: Host(`selenium.iamworkin.lan`)
-    services:
-    - name: selenium-hub
-      port: 4444
-  tls:
-    secretName: selenium-tls
--- a/apps/worldbuilder/README.md
+++ b/apps/worldbuilder/README.md
@@ -28,12 +28,9 @@ Source: `D:\git\FlowerCore\FlowerCore.WorldBuilder` (master)
   Memory: `feedback_rke2_image_import_per_node_scp`.
 3. **Bump image tag** in `worldbuilder.yaml` and git push.
   ArgoCD ApplicationSet picks up within ~3 minutes.
-4. **First production render** — open
-   `https://worldbuilder.iamworkin.lan/studio/c32e0000-0000-4000-8000-000000000004`
-   and confirm the Cyberpunk Blue Jay demo prompt loads with five seeded fake
-   generated images. This Sprint 32 visitor-safe profile uses
-   `ClientMode=fake`; switch the image-generation env vars back to ComfyUI only
-   for an operator-owned GPU render lane.
+4. **First production render** — open `https://worldbuilder.iamworkin.lan`,
+   create World → Character → Storyboard → ExportJob, confirm artifact
+   downloads. ComfyUI lives on BLUEJAY-WS at `http://10.0.56.20:8188`.

 ## Health probes

@@ -56,13 +53,8 @@ Source: `D:\git\FlowerCore\FlowerCore.WorldBuilder` (master)

 ## Image generation backend

-Sprint 32 pins the Kubernetes profile to
-`FlowerCore:WorldBuilder:ImageGeneration:ClientMode=fake` with
-`BaseUrl=http://127.0.0.1:1`. That keeps the public/internal visitor demo
-deterministic, avoids GPU exposure, and still exercises the studio/gallery
-surface with persisted generated-image metadata.
-
-The previous ComfyUI backend target was `http://10.0.56.20:8188` on
-BLUEJAY-WS (R9700 / gfx1201 / ROCm 7.2.1). Re-enable it only in an
-operator-owned follow-up that also verifies workstation reachability and image
-import freshness.
+`FlowerCore:WorldBuilder:ImageGeneration:BaseUrl=http://10.0.56.20:8188` —
+ComfyUI runs on BLUEJAY-WS Windows (R9700 / gfx1201 / ROCm 7.2.1). Pod reaches
+the workstation directly across the 10.0.56.0/24 VLAN (no Podman-style host-
+filter issues — K8s pods route via Calico, which is L3-routed across the
+VLAN).
--- a/apps/worldbuilder/worldbuilder.yaml
+++ b/apps/worldbuilder/worldbuilder.yaml
@@ -16,11 +16,7 @@ kind: Namespace
 metadata:
  name: fc-worldbuilder
  labels:
-    app.kubernetes.io/name: fc-worldbuilder
    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
 ---
 # SQLite DB + generated image gallery + PDF/PNG exports.
 # Longhorn RWO — single replica with `Recreate` rollout strategy keeps it safe.
@@ -29,13 +25,6 @@ kind: PersistentVolumeClaim
 metadata:
  name: worldbuilder-data
  namespace: fc-worldbuilder
-  labels:
-    app.kubernetes.io/name: worldbuilder-data
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
 spec:
  accessModes:
    - ReadWriteOnce
@@ -51,13 +40,7 @@ metadata:
  namespace: fc-worldbuilder
  labels:
    app.kubernetes.io/name: worldbuilder-web
-    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-  annotations:
-    flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
 spec:
  replicas: 1
  revisionHistoryLimit: 3
@@ -71,16 +54,11 @@ spec:
    metadata:
      labels:
        app.kubernetes.io/name: worldbuilder-web
-        app.kubernetes.io/component: web
        app.kubernetes.io/part-of: flowercore
-        app.kubernetes.io/managed-by: argocd
-        flowercore.io/tenant-id: system
-        flowercore.io/created-by: bluejay-infra
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics/prometheus"
-        flowercore.io/audit-trace-id: "worldbuilder-runtime-demo"
    spec:
      securityContext:
        fsGroup: 1654
@@ -114,14 +92,11 @@ spec:
              value: "/data/gallery"
            - name: FlowerCore__WorldBuilder__Export__RootPath
              value: "/data/exports"
-            # Visitor-safe Sprint 32 profile: fake backend keeps public demo
-            # rendering deterministic and avoids exposing BLUEJAY-WS GPU.
+            # ComfyUI on BLUEJAY-WS (R9700 / gfx1201 / ROCm 7.2.1).
            - name: FlowerCore__WorldBuilder__ImageGeneration__BaseUrl
-              value: "http://127.0.0.1:1"
+              value: "http://10.0.56.20:8188"
            - name: FlowerCore__WorldBuilder__ImageGeneration__ClientMode
-              value: "fake"
-            - name: FlowerCore__WorldBuilder__ImageGeneration__BackendId
-              value: "fake"
+              value: "comfyui"
          resources:
            # Cluster CPU-request budget runs hot (99% on all 3 nodes at deploy
            # time) while actual CPU usage is well below capacity. Idle Blazor
@@ -190,11 +165,7 @@ metadata:
  namespace: fc-worldbuilder
  labels:
    app.kubernetes.io/name: worldbuilder-web
-    app.kubernetes.io/component: web
    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
 spec:
  type: ClusterIP
  selector:
@@ -209,13 +180,6 @@ kind: Certificate
 metadata:
  name: worldbuilder-web-tls
  namespace: fc-worldbuilder
-  labels:
-    app.kubernetes.io/name: worldbuilder-web-tls
-    app.kubernetes.io/component: ingress
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
 spec:
  secretName: worldbuilder-web-tls
  issuerRef:
@@ -236,13 +200,6 @@ kind: IngressRoute
 metadata:
  name: worldbuilder-web
  namespace: fc-worldbuilder
-  labels:
-    app.kubernetes.io/name: worldbuilder-web
-    app.kubernetes.io/component: ingress
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
 spec:
  entryPoints:
    - websecure
--- a/docs/runbooks/openvoxserver-quadlet-durability.md
+++ b/docs/runbooks/openvoxserver-quadlet-durability.md
@@ -1,84 +0,0 @@
-# openvoxserver Quadlet Durability
-
-This runbook documents the noc1 `openvoxserver` durability fix for the Puppet control-repo deploy path. The service is a noc1 host artifact, not an ArgoCD application, so discovery always starts on noc1 rather than in `apps/*`.
-
-## Current State
-
-As of the Sprint 32 Cx-12 apply on 2026-05-17:
-
- `/etc/containers/systemd/openvoxserver.container` has a `GIT_SSH_COMMAND` environment entry that points at the persisted serverdata deploy key.
- `/etc/systemd/system/openvoxserver-safeconfig.service` is enabled and active, and reapplies `git config --global --add safe.directory *` inside the running container.
- `/opt/puppet/r10k-deploy.sh` self-heals before each fetch by setting `safe.directory`, the repo-local `core.sshCommand`, and the persisted `known_hosts` file when needed.
- `puppet-deploy.service` exits `0/SUCCESS` after the apply and the control repo reports `HEAD == origin/master`.
- `systemctl cat openvoxserver` does not currently resolve to a generated unit on noc1. The container is running through Podman with `restart=always`, so destructive recreate smoke must not run until the generated unit is present.
-
-## Discovery
-
-Run every command through noc1 as `fcadmin`; do not assume BLUEJAY-WS can reach container-local surfaces directly.
-
-```bash
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "hostname && sudo -n true"
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo find /etc/containers/systemd /usr/share/containers/systemd /etc/systemd/system -name 'openvoxserver*' 2>/dev/null"
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo sed -n '1,220p' /etc/containers/systemd/openvoxserver.container"
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo systemctl cat puppet-deploy.service"
-```
-
-If a future noc1 profile manages these files, update the Puppet control repo and let `puppet-deploy.service` apply the change. On 2026-05-17, host `puppet` was not installed, so Cx-12 used a direct noc1 host edit.
-
-## Durable Fix Shape
-
-The Quadlet keeps the deploy key as a path reference only:
-
-```ini
-Environment=GIT_SSH_COMMAND=ssh -i /opt/puppetlabs/server/data/puppetserver/.puppet-deploy-key -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes -o UserKnownHostsFile=/opt/puppetlabs/server/data/puppetserver/.known_hosts
-```
-
-The safeconfig service is intentionally independent of `openvoxserver.service` until the generated unit exists. It waits for the `openvoxserver` container name and then runs:
-
-```bash
-/usr/bin/podman exec openvoxserver git config --global --add safe.directory *
-```
-
-The deploy script self-heals inside the container before it fetches the control repo:
-
-```bash
-git config --global --add safe.directory "*" 2>/dev/null || true
-DEPLOY_KEY="/opt/puppetlabs/server/data/puppetserver/.puppet-deploy-key"
-KNOWN_HOSTS="/opt/puppetlabs/server/data/puppetserver/.known_hosts"
-REPO="/etc/puppetlabs/code/environments/production"
-export GIT_SSH_COMMAND="ssh -i $DEPLOY_KEY -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes -o UserKnownHostsFile=$KNOWN_HOSTS"
-git -C "$REPO" config core.sshCommand "$GIT_SSH_COMMAND" 2>/dev/null || true
-```
-
-## Validation
-
-Non-destructive validation:
-
-```bash
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo grep -n 'GIT_SSH_COMMAND' /etc/containers/systemd/openvoxserver.container"
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo systemctl status openvoxserver-safeconfig.service --no-pager -l"
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo systemctl start puppet-deploy.service && sudo systemctl status puppet-deploy.service --no-pager -l"
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "sudo podman exec openvoxserver git -C /etc/puppetlabs/code/environments/production config --get core.sshCommand"
-```
-
-Destructive recreate smoke is opt-in only:
-
-```bash
-scp scripts/monitoring/openvox-recreate-smoke.sh fcadmin@10.0.56.10:/tmp/openvox-recreate-smoke.sh
-ssh -i ~/.ssh/fcadmin_ed25519 fcadmin@10.0.56.10 "chmod +x /tmp/openvox-recreate-smoke.sh && sudo OPENVOX_RECREATE_SMOKE=1 /tmp/openvox-recreate-smoke.sh"
-```
-
-Do not run the smoke during normal sprint work. It stops and removes the production container before starting it again through systemd, and it now refuses to continue unless `systemctl cat openvoxserver` succeeds.
-
-## Credential Rotation Note
-
-When rotating the Puppet deploy key, update the persisted serverdata copy on noc1:
-
-```bash
-sudo install -m 0600 -o root -g root <new-deploy-key> /opt/puppet/serverdata/.puppet-deploy-key
-sudo podman exec openvoxserver sh -c "ssh-keyscan github.com > /opt/puppetlabs/server/data/puppetserver/.known_hosts"
-sudo systemctl start openvoxserver-safeconfig.service
-sudo systemctl start puppet-deploy.service
-```
-
-Never commit the deploy key or print it in logs.
--- a/scripts/monitoring/openvox-recreate-smoke.sh
+++ b/scripts/monitoring/openvox-recreate-smoke.sh
@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [ "${OPENVOX_RECREATE_SMOKE:-}" != "1" ]; then
-  echo "SKIP: set OPENVOX_RECREATE_SMOKE=1 to run the destructive openvoxserver recreate smoke." >&2
-  exit 64
-fi
-
-SUDO="${SUDO:-sudo}"
-REPO="/etc/puppetlabs/code/environments/production"
-CORE_SSH_COMMAND_FRAGMENT=".puppet-deploy-key"
-
-if ! $SUDO systemctl cat openvoxserver >/dev/null 2>&1; then
-  echo "SKIP: systemctl cat openvoxserver failed; refusing to remove a container without a verified systemd recreate path." >&2
-  exit 65
-fi
-
-before="$($SUDO podman exec openvoxserver git -C "$REPO" rev-parse --short HEAD)"
-echo "Before recreate: $before"
-
-$SUDO systemctl stop openvoxserver
-$SUDO podman rm openvoxserver 2>/dev/null || true
-$SUDO systemctl start openvoxserver
-
-sleep 50
-
-$SUDO systemctl start puppet-deploy.service
-sleep 5
-
-$SUDO systemctl status puppet-deploy.service --no-pager -l
-
-after="$($SUDO podman exec openvoxserver git -C "$REPO" rev-parse --short origin/master)"
-echo "After recreate origin/master: $after"
-
-$SUDO test -d /opt/puppet/code/environments/production/site-modules/profile/manifests
-
-core_ssh="$($SUDO podman exec openvoxserver git -C "$REPO" config --get core.sshCommand)"
-case "$core_ssh" in
-  *"$CORE_SSH_COMMAND_FRAGMENT"*) ;;
-  *)
-    echo "FAIL: core.sshCommand does not reference the persisted deploy key." >&2
-    exit 1
-    ;;
-esac
-
-$SUDO podman exec openvoxserver git -C "$REPO" status --short --branch
-
-echo "PASS: openvoxserver recreate smoke completed without git safety or deploy-key failure."
--- a/tests/bluejay-infra-lint/DivoomPiDeployArtifactTests.cs
+++ b/tests/bluejay-infra-lint/DivoomPiDeployArtifactTests.cs
@@ -1,206 +0,0 @@
-using FluentAssertions;
-using Xunit;
-
-namespace BluejayInfraLint.Tests;
-
-[Trait("Category", "Unit")]
-public sealed class DivoomPiDeployArtifactTests
-{
-    private static readonly string Root = FindRepoRoot();
-    private static readonly string DmRoot = Path.Combine(Root, "apps", "fc-divoom-dm-pi-device");
-    private static readonly string TvRoot = Path.Combine(Root, "apps", "fc-divoom-tv-pi");
-
-    public static TheoryData<string> DmRequiredArtifacts => new()
-    {
-        "README.md",
-        "hiera/edge2-divoom-dm-device.overlay.yaml",
-        "puppet/profile/pi/service/divoom_dm_device.pp",
-        "puppet/templates/divoom-device-registration.json.epp",
-        "puppet/templates/flowercore-divoom-dm-agent.service.epp",
-    };
-
-    public static TheoryData<string> TvRequiredArtifacts => new()
-    {
-        "README.md",
-        "hiera/example-divoom-tv-pi.iamworkin.lan.yaml",
-        "puppet/profile/pi/service/divoom_tv.pp",
-        "systemd/flowercore-divoom-tv.service",
-        "systemd/flowercore-divoom-tv-hdmi.service",
-        "systemd/99-flowercore-divoom-tv-hdmi.rules",
-        "scripts/flowercore-divoom-tv-prelaunch.sh",
-        "scripts/flowercore-divoom-tv-launch.sh",
-        "scripts/flowercore-divoom-tv-hdmi-respond.sh",
-    };
-
-    [Theory]
-    [MemberData(nameof(DmRequiredArtifacts))]
-    public void DmDeviceArtifacts_ArePresent(string relativePath)
-    {
-        File.Exists(Path.Combine(DmRoot, relativePath.Replace('/', Path.DirectorySeparatorChar))).Should().BeTrue(relativePath);
-    }
-
-    [Theory]
-    [MemberData(nameof(TvRequiredArtifacts))]
-    public void TvPiArtifacts_ArePresent(string relativePath)
-    {
-        File.Exists(Path.Combine(TvRoot, relativePath.Replace('/', Path.DirectorySeparatorChar))).Should().BeTrue(relativePath);
-    }
-
-    [Fact]
-    public void DmDeviceReadme_DeclaresPuppetSystemdNotKubernetes()
-    {
-        var readme = ReadDm("README.md");
-
-        readme.Should().Contain("not a Kubernetes application");
-        readme.Should().Contain("profile::pi::service::divoom");
-        readme.Should().Contain("no K8s surface");
-    }
-
-    [Fact]
-    public void DmHieraOverlay_PreservesExistingEdge2DivoomService()
-    {
-        var hiera = ReadDm("hiera/edge2-divoom-dm-device.overlay.yaml");
-
-        hiera.Should().Contain("fc-pimanager:");
-        hiera.Should().Contain("fc-divoom:");
-        hiera.Should().Contain("enabled: true");
-        hiera.Should().Contain("profile::pi::service::divoom_dm_device::service_enabled: false");
-        hiera.Should().Contain("profile::pi::service::divoom_dm_device::service_ensure: 'stopped'");
-    }
-
-    [Fact]
-    public void DmPuppetProfile_DefaultsToStoppedDisabledService()
-    {
-        var profile = ReadDm("puppet/profile/pi/service/divoom_dm_device.pp");
-
-        profile.Should().Contain("Boolean $service_enabled = false");
-        profile.Should().Contain("Enum['running', 'stopped'] $service_ensure = 'stopped'");
-        profile.Should().Contain("service { $service_name:");
-        profile.Should().Contain("ensure  => $service_ensure");
-        profile.Should().Contain("enable  => $service_enabled");
-    }
-
-    [Fact]
-    public void DmPuppetProfile_DoesNotManageLiveDivoomWebUnit()
-    {
-        var profile = ReadDm("puppet/profile/pi/service/divoom_dm_device.pp");
-
-        profile.Should().NotContain("Service['flowercore-divoom.service']");
-        profile.Should().NotContain("service { 'flowercore-divoom.service'");
-        profile.Should().NotContain("notify  => Service");
-    }
-
-    [Fact]
-    public void DmAgentUnit_IsSeparateAndGatedByExistingWrappers()
-    {
-        var unit = ReadDm("puppet/templates/flowercore-divoom-dm-agent.service.epp");
-
-        unit.Should().Contain("ConditionPathExists=<%= $divoom_install_dir %>/bt-link.sh");
-        unit.Should().Contain("ConditionPathExists=<%= $divoom_install_dir %>/bt-reset.sh");
-        unit.Should().Contain("ConditionPathExists=<%= $divoom_install_dir %>/audio-link.sh");
-        unit.Should().Contain("ExecStart=<%= $agent_binary_path %> --mode=Pi");
-        unit.Should().NotContain("flowercore-divoom.service");
-    }
-
-    [Fact]
-    public void DmRegistration_CarriesRenderProofAndSafetyPolicy()
-    {
-        var registration = ReadDm("puppet/templates/divoom-device-registration.json.epp");
-
-        registration.Should().Contain("\"candidateChannels\": <%= $bt_channels_json %>");
-        registration.Should().Contain("\"deviceInfoIsRenderProof\": false");
-        registration.Should().Contain("\"visibleRenderProofRequired\": <%= $visible_render_proof_required %>");
-        registration.Should().Contain("\"preserveExistingService\": \"flowercore-divoom.service\"");
-        registration.Should().Contain("\"doNotEnableFmRadio\": true");
-    }
-
-    [Fact]
-    public void TvService_UsesAvaloniaHdmiSafetyGates()
-    {
-        var unit = ReadTv("systemd/flowercore-divoom-tv.service");
-
-        unit.Should().Contain("ConditionPathExists=/opt/flowercore/divoom-tv/FlowerCore.Divoom.Tv");
-        unit.Should().Contain("Environment=XDG_RUNTIME_DIR=/run/fc-divoom-tv");
-        unit.Should().Contain("RuntimeDirectoryMode=0700");
-        unit.Should().Contain("ExecStartPre=/usr/local/bin/flowercore-divoom-tv-prelaunch.sh");
-        unit.Should().Contain("ExecStart=/usr/local/bin/flowercore-divoom-tv-launch.sh");
-        unit.Should().Contain("MemoryMax=2G");
-        unit.Should().Contain("PrivateTmp=true");
-        unit.Should().NotContain("/tmp");
-    }
-
-    [Fact]
-    public void TvLauncher_PrefersCageAndFallsBackToDirectLaunch()
-    {
-        var script = ReadTv("scripts/flowercore-divoom-tv-launch.sh");
-
-        script.Should().Contain("command -v cage");
-        script.Should().Contain("exec cage --");
-        script.Should().Contain("launching FlowerCore.Divoom.Tv directly");
-        script.Should().Contain("--target=hdmi");
-        script.Should().Contain("--presentation-mode=${PRESENTATION_MODE}");
-    }
-
-    [Fact]
-    public void TvHotplugRule_SettlesAndRestartsRenderer()
-    {
-        var rule = ReadTv("systemd/99-flowercore-divoom-tv-hdmi.rules");
-        var responder = ReadTv("scripts/flowercore-divoom-tv-hdmi-respond.sh");
-
-        rule.Should().Contain("KERNEL==\"card?-HDMI-A-?\"");
-        rule.Should().Contain("start flowercore-divoom-tv-hdmi.service");
-        responder.Should().Contain("sleep 2");
-        responder.Should().Contain("systemctl restart flowercore-divoom-tv.service");
-    }
-
-    [Fact]
-    public void TvPuppetProfile_InstallsCageAndStaticArtifacts()
-    {
-        var profile = ReadTv("puppet/profile/pi/service/divoom_tv.pp");
-
-        profile.Should().Contain("package { ['cage', 'libgbm1', 'libdrm2', 'libxkbcommon0', 'fonts-dejavu-core']");
-        profile.Should().Contain("'profile/pi/fc_divoom_tv/flowercore-divoom-tv.service'");
-        profile.Should().Contain("'profile/pi/fc_divoom_tv/flowercore-divoom-tv-launch.sh'");
-        profile.Should().Contain("profile/pi/fc_divoom_tv/99-flowercore-divoom-tv-hdmi.rules");
-        profile.Should().Contain("Boolean $service_enabled = false");
-    }
-
-    [Fact]
-    public void DivoomArtifacts_DoNotAddKubernetesWorkloads()
-    {
-        var allText = Directory.GetFiles(DmRoot, "*", SearchOption.AllDirectories)
-            .Concat(Directory.GetFiles(TvRoot, "*", SearchOption.AllDirectories))
-            .Select(File.ReadAllText);
-
-        foreach (var text in allText)
-        {
-            text.Should().NotContain("kind: Deployment");
-            text.Should().NotContain("kind: IngressRoute");
-            text.Should().NotContain("kind: Certificate");
-            text.Should().NotContain("kind: OnePasswordItem");
-        }
-    }
-
-    private static string ReadDm(string relativePath)
-        => File.ReadAllText(Path.Combine(DmRoot, relativePath.Replace('/', Path.DirectorySeparatorChar)));
-
-    private static string ReadTv(string relativePath)
-        => File.ReadAllText(Path.Combine(TvRoot, relativePath.Replace('/', Path.DirectorySeparatorChar)));
-
-    private static string FindRepoRoot()
-    {
-        var current = new DirectoryInfo(AppContext.BaseDirectory);
-        while (current is not null)
-        {
-            if (Directory.Exists(Path.Combine(current.FullName, "apps"))
-                && File.Exists(Path.Combine(current.FullName, "README.md")))
-            {
-                return current.FullName;
-            }
-
-            current = current.Parent;
-        }
-
-        throw new DirectoryNotFoundException("Could not find bluejay-infra root.");
-    }
-}
--- a/tests/bluejay-infra-lint/FleetManifestLintTests.cs
+++ b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
@@ -13,7 +13,6 @@ public sealed class FleetManifestLintTests

    private static readonly HashSet<string> PublicReadOnlyHosts = new(StringComparer.Ordinal)
    {
-        "brochure.flowercore.io",
        "dist.flowercore.io",
        "dns.iamworkin.lan",
    };
@@ -67,7 +66,6 @@ public sealed class FleetManifestLintTests
        ["github-runner-chat"] = "https://github.com/astoltz/FlowerCore.Chat",
        ["github-runner-mysql"] = "https://github.com/astoltz/FlowerCore.MySQL",
        ["github-runner-kiosk-linux"] = "https://github.com/astoltz/FlowerCore.Kiosk.Linux",
-        ["github-runner-updater"] = "https://github.com/astoltz/FlowerCore.Updater",
    };

    private static readonly HashSet<string> ScaledLinuxRunnerDeployments = new(StringComparer.Ordinal)
@@ -81,7 +79,6 @@ public sealed class FleetManifestLintTests
        "github-runner-chat",
        "github-runner-mysql",
        "github-runner-kiosk-linux",
-        "github-runner-updater",
    };

    private static readonly IReadOnlyDictionary<string, string> WritableRunnerEnv = new Dictionary<string, string>(StringComparer.Ordinal)
@@ -236,7 +233,7 @@ public sealed class FleetManifestLintTests
        {
            deployments.Should().ContainKey(expectedRunner.Key);

-            var container = deployments[expectedRunner.Key].MainContainerMappings().Should().ContainSingle().Subject;
+            var container = deployments[expectedRunner.Key].ContainerMappings().Should().ContainSingle().Subject;
            EnvValue(container, "REPO_URL").Should().Be(expectedRunner.Value);
            EnvValue(container, "EPHEMERAL").Should().Be("true");
            EnvValue(container, "LABELS").Should().Be("self-hosted,linux,fc-build-linux");
@@ -252,7 +249,7 @@ public sealed class FleetManifestLintTests
    {
        foreach (var deployment in GitHubRunnerDeployments().Values)
        {
-            var container = deployment.MainContainerMappings().Should().ContainSingle().Subject;
+            var container = deployment.ContainerMappings().Should().ContainSingle().Subject;

            foreach (var expectedEnv in WritableRunnerEnv)
            {
@@ -279,10 +276,7 @@ public sealed class FleetManifestLintTests
        foreach (var deploymentName in ScaledLinuxRunnerDeployments)
        {
            var deployment = deployments[deploymentName];
-            // Scaled runners must have >= 2 replicas (avoid single-pod bottleneck).
-            // Individual deployments may be tuned upward per CI activity — see
-            // "runners: right-size replica counts per 14d CI activity (#24)".
-            ReplicaCount(deployment).Should().BeGreaterOrEqualTo(2, $"{deploymentName} is in the scaled set and must run with at least 2 replicas");
+            ReplicaCount(deployment).Should().Be(2);

            var volumes = deployment.MappingSequence("spec", "template", "spec", "volumes");
            var claimNames = volumes
@@ -308,108 +302,6 @@ public sealed class FleetManifestLintTests
            .Be("github-runner-nuget-cache");
    }

-    [Fact]
-    public void Runners_MustNotPinToOperatorWorkstationHosts()
-    {
-        // CRITICAL SAFETY (operator directive 2026-05-26): BLUEJAY-WS is the
-        // operator's primary workstation — host of the 1Password Connect
-        // bearer token, fcadmin SSH keys to noc1, signing CA private keys,
-        // and source for every FC repo. A self-hosted GitHub Actions runner
-        // there would execute arbitrary PR code with that local access.
-        // Build-side analog of the Sprint 9 NEW safe-account exclusion gate
-        // (Puppet GPO/AppLocker/WDAC/audit-forwarder modules refuse to apply
-        // on BLUEJAY-WS). This lint asserts no GitHub-runner Deployment in
-        // apps/github-runner/ pins to a forbidden operator-workstation host
-        // via nodeName, nodeSelector, nodeAffinity, or tolerations.
-        // Existing legacy `bluejay-ws-sandbox-1` GitHub-registered runner is
-        // out of scope here (it's a runtime registration, not a K8s
-        // Deployment) — see CLAUDE.md "Common Mistakes" entry and
-        // feedback_bluejay_ws_never_public_runner.md.
-        var forbiddenHostPatterns = new[]
-        {
-            "bluejay-ws",
-            "BLUEJAY-WS",
-            "bluejay-ws.iamworkin.lan",
-            "iamworkin-ws",
-        };
-
-        bool ContainsForbidden(string? value) =>
-            !string.IsNullOrWhiteSpace(value)
-            && forbiddenHostPatterns.Any(pattern => value!.Contains(pattern, StringComparison.OrdinalIgnoreCase));
-
-        var violations = GitHubRunnerDeployments().Values.SelectMany(deployment =>
-        {
-            var local = new List<string>();
-            var podSpec = ManifestNodeExtensions.Mapping(deployment.Root, "spec", "template", "spec");
-            if (podSpec is null)
-            {
-                return local;
-            }
-
-            // nodeName: pins the pod to a specific node by name.
-            var nodeName = ManifestNodeExtensions.Scalar(podSpec, "nodeName");
-            if (ContainsForbidden(nodeName))
-            {
-                local.Add($"{deployment.Name} sets nodeName='{nodeName}' which targets a forbidden operator-workstation host.");
-            }
-
-            // nodeSelector: dict of label → value pinning the pod to nodes
-            // carrying matching labels. Examples that would trip this:
-            //   kubernetes.io/hostname: bluejay-ws
-            //   flowercore.io/host: bluejay-ws.iamworkin.lan
-            var nodeSelector = ManifestNodeExtensions.Mapping(podSpec, "nodeSelector");
-            if (nodeSelector is not null)
-            {
-                foreach (var entry in nodeSelector.Children)
-                {
-                    var key = entry.Key is YamlScalarNode keyScalar ? keyScalar.Value : null;
-                    var value = entry.Value is YamlScalarNode valueScalar ? valueScalar.Value : null;
-                    if (ContainsForbidden(value))
-                    {
-                        local.Add($"{deployment.Name} has nodeSelector entry '{key}: {value}' which targets a forbidden operator-workstation host.");
-                    }
-                }
-            }
-
-            // nodeAffinity: matchExpressions over node labels.
-            foreach (var term in ManifestNodeExtensions.MappingSequence(podSpec, "affinity", "nodeAffinity", "requiredDuringSchedulingIgnoredDuringExecution", "nodeSelectorTerms"))
-            {
-                foreach (var expr in ManifestNodeExtensions.MappingSequence(term, "matchExpressions"))
-                {
-                    var key = ManifestNodeExtensions.Scalar(expr, "key");
-                    foreach (var valueNode in ManifestNodeExtensions.ScalarSequence(expr, "values"))
-                    {
-                        if (ContainsForbidden(valueNode))
-                        {
-                            local.Add($"{deployment.Name} has nodeAffinity matchExpression '{key}' value '{valueNode}' which targets a forbidden operator-workstation host.");
-                        }
-                    }
-                }
-            }
-
-            // tolerations: scheduling onto a tainted operator-workstation
-            // node would let the runner run there. Forbid any toleration
-            // value that names the workstation.
-            foreach (var toleration in ManifestNodeExtensions.MappingSequence(podSpec, "tolerations"))
-            {
-                var key = ManifestNodeExtensions.Scalar(toleration, "key");
-                var value = ManifestNodeExtensions.Scalar(toleration, "value");
-                if (ContainsForbidden(key))
-                {
-                    local.Add($"{deployment.Name} has toleration key '{key}' which targets a forbidden operator-workstation host.");
-                }
-                if (ContainsForbidden(value))
-                {
-                    local.Add($"{deployment.Name} has toleration value '{value}' which targets a forbidden operator-workstation host.");
-                }
-            }
-
-            return local;
-        }).ToList();
-
-        violations.Should().BeEmpty("BLUEJAY-WS / iamworkin-ws must never host a fleet GitHub Actions runner; see CLAUDE.md 'Registering BLUEJAY-WS as a fleet GitHub Actions runner' and feedback_bluejay_ws_never_public_runner.md");
-    }
-
    [Fact]
    public void Monitoring_MustAlertWhenLinuxRunnerDeploymentIsUnavailable()
    {
@@ -528,184 +420,6 @@ public sealed class FleetManifestLintTests
        violations.Should().BeEmpty();
    }

-    [Fact]
-    public void FcDeviceManagement_MustShipExpectedManifestSet()
-    {
-        var appRoot = Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt");
-        Directory.Exists(appRoot).Should().BeTrue("Sprint 8 Cx-5 owns apps/fc-devicemgmt.");
-
-        var expectedFiles = new[]
-        {
-            "1password-item.yaml",
-            "argocd-application.yaml",
-            "certificate-web.yaml",
-            "clusterrole-operator.yaml",
-            "clusterrolebinding-operator.yaml",
-            "deployment-operator.yaml",
-            "deployment-web.yaml",
-            "ingressroute-web.yaml",
-            "namespace.yaml",
-            "network-policy.yaml",
-            "service-web.yaml",
-            "serviceaccount-operator.yaml",
-        };
-
-        Directory.GetFiles(appRoot, "*.yaml")
-            .Select(Path.GetFileName)
-            .Should()
-            .BeEquivalentTo(expectedFiles);
-
-        foreach (var expectedFile in expectedFiles)
-        {
-            FcDeviceManagementDocuments()
-                .Should()
-                .Contain(document => document.RelativePath == $"fc-devicemgmt/{expectedFile}");
-        }
-    }
-
-    [Fact]
-    public void FcDeviceManagement_ObjectsMustCarryStandardTraceabilityLabels()
-    {
-        var requiredLabels = new[]
-        {
-            "app.kubernetes.io/name",
-            "app.kubernetes.io/part-of",
-            "app.kubernetes.io/managed-by",
-            "flowercore.io/tenant-id",
-            "flowercore.io/created-by",
-        };
-
-        var violations = FcDeviceManagementDocuments()
-            .SelectMany(document => requiredLabels
-                .Where(label => string.IsNullOrWhiteSpace(document.Scalar("metadata", "labels", label)))
-                .Select(label => $"{document.Descriptor} is missing metadata.labels['{label}']."))
-            .Concat(FcDeviceManagementDocuments()
-                .Where(document => document.Kind == "Deployment")
-                .SelectMany(document => requiredLabels
-                    .Where(label => string.IsNullOrWhiteSpace(document.Scalar("spec", "template", "metadata", "labels", label)))
-                    .Select(label => $"{document.Descriptor} pod template is missing metadata.labels['{label}'].")))
-            .Concat(FcDeviceManagementDocuments()
-                .Where(document => document.Kind == "Deployment")
-                .Where(document => string.IsNullOrWhiteSpace(document.Scalar("spec", "template", "metadata", "annotations", "flowercore.io/audit-trace-id")))
-                .Select(document => $"{document.Descriptor} pod template is missing flowercore.io/audit-trace-id."))
-            .ToList();
-
-        violations.Should().BeEmpty();
-    }
-
-    [Fact]
-    public void FcDeviceManagement_IngressMustUseCertManagerAndKeepPublicHostDisabled()
-    {
-        var appText = string.Join(
-            Environment.NewLine,
-            Directory.GetFiles(Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt"), "*.yaml")
-                .Select(File.ReadAllText));
-
-        appText.Should().NotContain("certResolver");
-        appText.Should().Contain("update.flowercore.io");
-        appText.Should().Contain("disabled-until-Q-OIDC-1");
-
-        FcDeviceManagementDocuments()
-            .Where(document => document.Kind == "IngressRoute")
-            .SelectMany(document => document.MappingSequence("spec", "routes"))
-            .Select(route => ManifestNodeExtensions.Scalar(route, "match") ?? string.Empty)
-            .Should()
-            .Contain(match => match.Contains("Host(`devices.iamworkin.lan`)", StringComparison.Ordinal))
-            .And.NotContain(match => match.Contains("Host(`update.flowercore.io`)", StringComparison.Ordinal));
-
-        var certificate = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "Certificate" && document.Name == "fc-devicemgmt-web-tls");
-
-        certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
-        certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
-        ManifestNodeExtensions.ScalarSequence(certificate.Root, "spec", "dnsNames")
-            .Should()
-            .ContainSingle("devices.iamworkin.lan");
-    }
-
-    [Fact]
-    public void FcDeviceManagement_OperatorRbacMustCoverDevicesAndOwnerLookup()
-    {
-        var clusterRole = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "ClusterRole" && document.Name == "fc-devicemgmt-operator");
-        var allScalars = clusterRole.AllScalars().ToList();
-
-        allScalars.Should().Contain("devices.flowercore.io");
-        allScalars.Should().Contain("*");
-        allScalars.Should().Contain("deployments");
-        allScalars.Should().Contain("get");
-
-        var operatorDeployment = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "Deployment" && document.Name == "fc-devicemgmt-operator");
-
-        operatorDeployment.AllScalars().Should().Contain("FLOWERCORE_KUBERNETES_OWNER_DEPLOYMENT");
-        operatorDeployment.AllScalars().Should().Contain("fc-devicemgmt-operator");
-    }
-
-    [Fact]
-    public void FcDeviceManagement_RuntimeSecretsMustUseOnePasswordItemPattern()
-    {
-        var item = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "OnePasswordItem" && document.Name == "fc-devicemgmt-runtime");
-
-        item.Scalar("spec", "itemPath")
-            .Should()
-            .Be("vaults/IAmWorkin/items/FlowerCore DeviceManagement Runtime");
-
-        var appText = string.Join(
-            Environment.NewLine,
-            Directory.GetFiles(Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt"), "*.yaml")
-                .Select(File.ReadAllText));
-
-        FcDeviceManagementDocuments().Should().NotContain(document => document.Kind == "Secret");
-        appText.Should().Contain("secretKeyRef:");
-        appText.Should().Contain("secretName: fc-devicemgmt-runtime");
-        appText.Should().NotContain("stringData:");
-        appText.Should().NotContain("from-literal");
-        appText.Should().NotContain("tls.key:");
-    }
-
-    [Fact]
-    public void FcDeviceManagement_NetworkPoliciesMustAllowLanAgentsSynologyAndDnatPorts()
-    {
-        var policies = FcDeviceManagementDocuments()
-            .Where(document => document.Kind == "NetworkPolicy")
-            .ToList();
-
-        policies.Should().HaveCount(2);
-
-        var combinedScalars = policies.SelectMany(policy => policy.AllScalars()).ToList();
-        combinedScalars.Should().Contain("10.0.56.0/24");
-        combinedScalars.Should().Contain("10.0.57.0/24");
-        combinedScalars.Should().Contain("10.0.58.0/24");
-        combinedScalars.Should().Contain("10.0.68.0/27");
-        combinedScalars.Should().Contain("10.0.58.3/32");
-
-        var combinedEgressPorts = policies.SelectMany(policy => policy.EgressPorts()).ToHashSet(StringComparer.Ordinal);
-        combinedEgressPorts.Should().Contain(new[] { "80", "443", "8080", "8443", "2049", "111" });
-
-        var traefikVipPolicies = policies
-            .Where(policy => policy.AllScalars().Any(value => value.Contains("10.0.56.200", StringComparison.Ordinal)))
-            .ToList();
-
-        traefikVipPolicies.Should().ContainSingle();
-        traefikVipPolicies[0].EgressPorts().Should().Contain(new[] { "80", "443", "8080", "8443" });
-    }
-
-    [Fact]
-    public void FcDeviceManagement_ArgocdApplicationMustMatchApplicationSetDiscoveryConventions()
-    {
-        var application = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "Application" && document.Name == "infra-fc-devicemgmt");
-
-        application.Namespace.Should().Be("argocd");
-        application.Scalar("spec", "source", "repoURL")
-            .Should()
-            .Be("http://gitea-clusterip.gitea.svc.cluster.local:3000/bluejay/bluejay-infra.git");
-        application.Scalar("spec", "source", "path").Should().Be("apps/fc-devicemgmt");
-        application.Scalar("spec", "destination", "namespace").Should().Be("fc-devicemgmt");
-    }
-
    private static IEnumerable<string> ProbeViolations(
        ManifestDocument document,
        YamlMappingNode container,
@@ -767,13 +481,6 @@ public sealed class FleetManifestLintTests
        return ManifestNodeExtensions.MappingSequence(container, "env")
            .SingleOrDefault(env => string.Equals(ManifestNodeExtensions.Scalar(env, "name"), name, StringComparison.Ordinal));
    }
-
-    private static IReadOnlyList<ManifestDocument> FcDeviceManagementDocuments()
-    {
-        return Inventory.Documents
-            .Where(document => document.RelativePath.StartsWith("fc-devicemgmt/", StringComparison.Ordinal))
-            .ToList();
-    }
 }

 internal sealed class ManifestInventory
@@ -997,22 +704,6 @@ internal sealed record ManifestDocument(
            .ToList();
    }

-    // MainContainerMappings excludes initContainers. Use this when asserting
-    // properties of the primary container (env, image, volumeMounts) where an
-    // initContainer would be a false-positive match — e.g. the GitHub runner
-    // image's `setup-runner-home` initContainer should not count toward the
-    // single-container assertions on the runner deployments.
-    public IReadOnlyList<YamlMappingNode> MainContainerMappings()
-    {
-        var podSpec = PodSpec();
-        if (podSpec is null)
-        {
-            return Array.Empty<YamlMappingNode>();
-        }
-
-        return ManifestNodeExtensions.MappingSequence(podSpec, "containers").ToList();
-    }
-
    public IReadOnlyList<ContainerSpec> ContainerSpecs()
    {
        return ContainerMappings()
--- a/tests/bluejay-infra-lint/OpenVoxServerDurabilityTests.cs
+++ b/tests/bluejay-infra-lint/OpenVoxServerDurabilityTests.cs
@@ -1,99 +0,0 @@
-using FluentAssertions;
-using Xunit;
-
-namespace BluejayInfraLint.Tests;
-
-[Trait("Category", "Unit")]
-public sealed class OpenVoxServerDurabilityTests
-{
-    private static readonly string Root = FindRepoRoot();
-    private static readonly string RunbookPath = Path.Combine(Root, "docs", "runbooks", "openvoxserver-quadlet-durability.md");
-    private static readonly string SmokePath = Path.Combine(Root, "scripts", "monitoring", "openvox-recreate-smoke.sh");
-
-    [Fact]
-    public void Runbook_DocumentsHostArtifactAndNonArgoPath()
-    {
-        var runbook = File.ReadAllText(RunbookPath);
-
-        runbook.Should().Contain("noc1 host artifact");
-        runbook.Should().Contain("not an ArgoCD application");
-        runbook.Should().Contain("systemctl cat openvoxserver");
-        runbook.Should().Contain("/etc/containers/systemd/openvoxserver.container");
-    }
-
-    [Fact]
-    public void Runbook_DocumentsCx12LiveApplyState()
-    {
-        var runbook = File.ReadAllText(RunbookPath);
-
-        runbook.Should().Contain("Sprint 32 Cx-12");
-        runbook.Should().Contain("openvoxserver-safeconfig.service");
-        runbook.Should().Contain("/opt/puppet/r10k-deploy.sh");
-        runbook.Should().Contain("HEAD == origin/master");
-    }
-
-    [Fact]
-    public void SmokeScript_IsExplicitlyOptIn()
-    {
-        var smoke = File.ReadAllText(SmokePath);
-
-        smoke.Should().Contain("OPENVOX_RECREATE_SMOKE");
-        smoke.Should().Contain("exit 64");
-        smoke.IndexOf("OPENVOX_RECREATE_SMOKE", StringComparison.Ordinal)
-            .Should().BeLessThan(smoke.IndexOf("systemctl stop openvoxserver", StringComparison.Ordinal));
-    }
-
-    [Fact]
-    public void SmokeScript_RequiresGeneratedSystemdUnitBeforeRemovingContainer()
-    {
-        var smoke = File.ReadAllText(SmokePath);
-
-        smoke.Should().Contain("systemctl cat openvoxserver");
-        smoke.Should().Contain("refusing to remove a container without a verified systemd recreate path");
-        smoke.IndexOf("systemctl cat openvoxserver", StringComparison.Ordinal)
-            .Should().BeLessThan(smoke.IndexOf("podman rm openvoxserver", StringComparison.Ordinal));
-    }
-
-    [Fact]
-    public void Artifacts_DoNotStoreSecretsOrPaidRunnerLabels()
-    {
-        var forbidden = new[]
-        {
-            "BEGIN OPENSSH PRIVATE KEY",
-            "BEGIN RSA PRIVATE KEY",
-            "ubuntu-latest",
-            "windows-latest",
-            "macos-latest",
-        };
-
-        var violations = new[] { RunbookPath, SmokePath }
-            .SelectMany(path =>
-            {
-                var text = File.ReadAllText(path);
-                return forbidden
-                    .Where(token => text.Contains(token, StringComparison.OrdinalIgnoreCase))
-                    .Select(token => $"{Path.GetRelativePath(Root, path)} contains forbidden token {token}");
-            })
-            .ToList();
-
-        violations.Should().BeEmpty();
-    }
-
-    private static string FindRepoRoot()
-    {
-        var current = new DirectoryInfo(AppContext.BaseDirectory);
-        while (current is not null)
-        {
-            if (Directory.Exists(Path.Combine(current.FullName, "apps"))
-                && Directory.Exists(Path.Combine(current.FullName, "scripts"))
-                && File.Exists(Path.Combine(current.FullName, "README.md")))
-            {
-                return current.FullName;
-            }
-
-            current = current.Parent;
-        }
-
-        throw new DirectoryNotFoundException("Could not find bluejay-infra root.");
-    }
-}
--- a/tests/bluejay-infra-lint/conftest.dev/02_public_method_allowlist.rego
+++ b/tests/bluejay-infra-lint/conftest.dev/02_public_method_allowlist.rego
@@ -1,6 +1,6 @@
 package bluejayinfra.public_method_allowlist

-public_hosts := {"brochure.flowercore.io", "dist.flowercore.io", "dns.iamworkin.lan"}
+public_hosts := {"dist.flowercore.io", "dns.iamworkin.lan"}

 deny[msg] {
  input.kind == "IngressRoute"