chore: remove obsolete migration code and docsHEADmain

1 files changed, 50 insertions, 62 deletions

diff --git a/docs/GUIX.txt b/docs/GUIX.txt
index 05aa572..89f4c9a 100644
--- a/docs/GUIX.txt
+++ b/docs/GUIX.txt
@@ -37,9 +37,8 @@ BUILD LOCAL
     binaries, browser assets and saved images. No compilation on recovery host.
     Podman info smoke test is not clean-host/container lifecycle proof.
 
-    Ordinary pack uses canonical /gnu/store. Former -RR wrapper creates one-ID
-    user namespace; privileged helpers cannot map host subordinate IDs there.
-    Builder's canonical store could bypass relocation and hide this defect.
+    Ordinary pack uses canonical /gnu/store. Relocatable -RR wrappers create a
+    one-ID user namespace incompatible with required subordinate UID mappings.
     https://guix.gnu.org/manual/devel/en/html_node/Invoking-guix-pack.html
     https://guix.gnu.org/manual/devel/en/html_node/Replicating-Guix.html
     https://raw.githubusercontent.com/containers/podman/main/docs/tutorials/rootless_tutorial.md
@@ -48,7 +47,7 @@ MAKE CARRY FILE
 
     Production: create consistent encrypted export; copy and verify it locally:
 
-        ./bin/stack backup --include-images
+        ./bin/run backup --include-images
 
     Bundle a trusted freshly checked release with that export:
 
@@ -132,23 +131,19 @@ CHECKS; DEPLOYMENT GATE
     No strict Rust/Clippy/Rustdoc, typed ESLint, LibreJS or crypto gate weakened.
     Existing documented lint/dependency exceptions remain unchanged.
 
-    Clean-host test exposed missing distro container signature policy. Image load
-    now supplies a temporary policy: reject by default; accept local Docker/OCI
-    archives only. Export supplies a separate temporary policy accepting only
-    containers-storage; registry transport remains rejected. Verified archive
-    manifests and architecture/layer/image-ID locks
-    still gate startup. Registry transport is not accepted by this load policy;
-    global host policy stays unchanged. Policies are generated by AGPL Rust code;
-    the foreign schema rejects comment/legal metadata, so no headerless source file
-    is added. The initial failed VM retained decrypted data and pending intent.
-
-    A second clean-host check found legacy backups had collapsed Caddy's /data
-    and /config into one caddy/ tree. After manifest verification, backup restore
-    moves credentials into data/caddy and autosave into config/caddy; bytes and
-    permissions are retained. Conflicting old/new layouts are refused before
-    publishing a destination. New exports copy /data/. and /config/. separately.
-
-    Before production, in order:
+    Image import supplies a temporary reject-by-default policy accepting local
+    Docker/OCI archives only. Export separately accepts containers-storage.
+    Manifest, architecture/layer/image-ID locks still gate startup; global host
+    policy stays unchanged. Generated protocol JSON cannot contain legal metadata;
+    its AGPL Rust generator carries the notice. POLICY.txt.
+
+    Legacy backups may have a collapsed Caddy caddy/ tree. Verified backup restore
+    moves credentials to data/caddy and autosave to config/caddy, preserving bytes
+    and permissions. Conflicting layouts are refused before publication. Current
+    exports copy /data/. and /config/. separately. Keep this compatibility path
+    while retained backups depend on it.
+
+    For each release, before production:
     1. Full checked release with real Guix runtime and source/binary pair.
     2. Fresh host without Guix/distro Podman/Git/GPG: offline bootstrap/restore;
        four services, exact images, detached UID/network helpers.
@@ -160,48 +155,41 @@ CHECKS; DEPLOYMENT GATE
     6. Fresh verified independent production backup; deploy only prebuilt release;
        verify public routes/state, retain prior release/runtime and encrypted export.
 
-    Rollback: stop new containers before old runtime binds production ports.
-    Keep .env/var/data; never delete closure entries used by running processes.
-
-VERIFIED — 2026-11-01
-
-    Offline KVM guest: official Debian 12 x86_64 image, no initial /gnu, Guix,
-    Podman, Git or GPG. Host supplies only documented kernel/account prerequisites.
-    Network restricted before bootstrap; readonly carry file plus separately
-    forwarded GPG agent; no private key copied. Bootstrap and one restore command
-    loaded four saved images and started all services without source builds.
-
-    Strict HTTPS verified all four domains using original certificates; both WKD
-    routes matched the original key. All 651 immutable snapshot files matched
-    after legacy Caddy path normalization: 18 active TLS keys, 16 certificates.
-    All 126 release source/binary files matched. Original .env, owner fingerprint
-    and every canonical SQLite table matched. Production snapshot contained zero
-    conversations/messages; original real-message decryption therefore untestable.
-    Disposable Chromium/Firefox tests verified both participant identities,
-    54-message history, encrypted snapshots/recovery and GNU LibreJS 7.21.1.
-
-    Full local release gates passed live npm/Rust advisory checks, strict fmt,
-    Clippy, Rustdoc, typed ESLint and both TypeScript compilers; no suppressions.
-    Required OpenSSL 3.6.5 hybrid suites, protected OpenPGP v6 identity, wrong-pass
-    and tamper controls passed. Synthetic shell tests cover bootstrap collisions,
-    interrupted recovery/retry, lock exclusion and child descriptor closure.
-
-    Runtime: 500687877 bytes, SHA256:
+    Retain a verified independent export and complete original worktree,
+    binary/launcher, installed unit, var/state.json, image-lock.json, images.tar
+    and engine storage. Activation replaces public source and image metadata.
+    Stop/cancel the new unit and stop Guix containers before rollback; confirm
+    inactivity before moving engine trees. Retain the new tree, restore old engine
+    path/metadata/worktree/launcher/unit and reload the user manager. For a Guix
+    rollback use the restored prior bin/run, which selects its matching runtime.
+    Only a host-tools release uses host PATH with Guix overrides unset.
+    Preserve CURRENT .env/var/data; never extract retained copies over live data.
+    Old releases do not remove newer Guix launcher/runtime files automatically.
+    Never delete store entries still used by retained/running tools.
+
+DEPLOYED BASELINE — 2026-11-01
+
+    Signed commit 9349a2d deployed packed Podman 5.7.0 and four rootless services.
+    Production .env, owner, every SQLite table and all 34 TLS key/certificate files
+    matched. All 126 release source/binary files, public HTTPS/WKD, search and
+    packed conmon paths verified. Only two ACME renewal retry timestamps changed.
+
+    A fresh Debian 12 x86_64 KVM guest had no Guix/Podman/Git/GPG. Network was
+    restricted before readonly-carry bootstrap/restore; GPG used a restricted
+    forwarded agent, never a copied secret key. Restore, export/second recovery
+    and final VM reboot passed; all 651 immutable snapshot files matched.
+    Production-host reboot was not performed. The production database had zero
+    conversations/messages; real historical-message decryption was untestable.
+    Disposable browser tests recovered 54-message history with both identities;
+    Firefox GNU LibreJS 7.21.1 rejected its unlicensed control.
+
+    Tested runtime SHA256:
         c5c7b849da152ee7a98b01602a1e91285ce4e3a80021a9cecb5f1e594dfc7810
-    Guix channel 230aa373f315f247852ee07dff34146e9b480aec; 113 store entries.
-    Git 2.52.0, GnuPG 2.4.7, Podman 5.7.0, conmon 2.1.13, crun 1.25.1.
-    Empty helper lists force PATH lookup, selecting packed conmon/crun. Ordinary
-    host config stays unchanged. Rootless cleanup handles immutable user-owned
-    temporary trees without changing symlink targets or the published pack.
+    Its channel provenance is included in bin/guix-channels.scm. New source/packs
+    require their own checks. Empty helper lists select Guix tools through PATH;
+    ordinary host configuration stays unchanged.
     https://github.com/containers/podman/blob/v5.7.0/vendor/go.podman.io/common/pkg/config/config.go#L849-L875
     https://github.com/containers/podman/blob/v5.7.0/cmd/podman/images/save.go#L91-L94
 
-    Deployment gate above still applies to each carried artifact. Retain complete
-    original worktree, binary/launcher, installed user unit and engine storage
-    independently before activation. Reload the installed unit after switching to
-    bin/run. For rollback stop Guix containers first, retain their engine tree,
-    restore prior engine path, binary/launcher and unit; invoke prior activation
-    with host PATH and Guix CONTAINERS_CONF overrides unset. Keep current .env and
-    var/data. An old release alone does not remove a newer Guix launcher/runtime.
-    Private evidence: var/guix-*.log and .tools/guix-production/. These are ignored
-    and include private state hashes; do not publish them with public source.
+    Private evidence: var/guix-*.log and .tools/guix-production/; these include
+    private state hashes and stay ignored. Do not publish them with source.