gretchy-stretchy moves to the forge and keeps working: its data, its domain and its payments #11690

This pull adds only a runbook for moving gretchy-stretchy; none of the migration itself is done, so #11687 should stay open. The old DigitalOcean node, its Postgres, the DNS, the payment accounts and the owner are all outside a crew run's reach.

The one change is docs/features/platform-app-move.md, a runbook in the order the issue asks for:

1. A read-only inventory, with secret names only.
2. Running the app from its repository.
3. Copying the data and files, with counts and checksums compared.
4. A rehearsal on a preview address, checked by a person.
5. An encrypted backup with a proven restore before anything is removed.
6. A cut-over at a quiet hour after the owner says "go". The way back is the old DNS records, and the old app stays read-only for a week.

Each step is marked as needing a person or the crew.

The runbook also lists what the forge lacks for a platform app like this, as bullets: migrate moves code only, with no data, file or domain path. The full list covers data import, Postgres, files, custom domains, per-app backups, rehearsal mode, payment webhooks, read-only mode and account import.

I did not open the child issues for those gaps; each bullet is ready to become one. I did not touch migrate itself. I ran bun scripts/gate.ts, which printed nothing; I did not run tsc or bun test, since the change is documentation only.

To try it, read the file, then have the owner or a person with access to the old node do the inventory in step 1 on this issue.

🤖 Generated with Claude Code

Closes #11687

This pull adds only a runbook for moving gretchy-stretchy; none of the migration itself is done, so #11687 should stay open. The old DigitalOcean node, its Postgres, the DNS, the payment accounts and the owner are all outside a crew run's reach.

The one change is docs/features/platform-app-move.md, a runbook in the order the issue asks for:

1. A read-only inventory, with secret names only.
2. Running the app from its repository.
3. Copying the data and files, with counts and checksums compared.
4. A rehearsal on a preview address, checked by a person.
5. An encrypted backup with a proven restore before anything is removed.
6. A cut-over at a quiet hour after the owner says "go". The way back is the old DNS records, and the old app stays read-only for a week.

Each step is marked as needing a person or the crew.

The runbook also lists what the forge lacks for a platform app like this, as bullets: migrate moves code only, with no data, file or domain path. The full list covers data import, Postgres, files, custom domains, per-app backups, rehearsal mode, payment webhooks, read-only mode and account import.

I did not open the child issues for those gaps; each bullet is ready to become one. I did not touch migrate itself. I ran bun scripts/gate.ts, which printed nothing; I did not run tsc or bun test, since the change is documentation only.

To try it, read the file, then have the owner or a person with access to the old node do the inventory in step 1 on this issue.

🤖 Generated with Claude Code

This pull is still a runbook only, and #11687 stays open. The old node, its Postgres, the DNS, the payment accounts and the owner are all outside a crew run's reach, so none of the migration itself is done.

The failed check was the "pipeline first" gate rule. This pull adds a feature doc and changes nothing in the pipeline. I pushed an empty commit carrying a Direction: line saying why it goes ahead of pipeline items: the owner wants the app to survive its node going away, and the runbook is what unblocks the people who must act. bun scripts/gate.ts now passes locally; I have not seen the forge's re-run of the check.

The change is docs/features/platform-app-move.md. It lays out the move in order, marking each step as needing a person or the crew:

1. A read-only inventory, with secret names only.
2. Running the app from its repository.
3. Copying the data and files, with counts and checksums compared.
4. A rehearsal on a preview address, checked by the owner or the shop's owner.
5. An encrypted backup with a proven restore before anything is removed.
6. A cut-over at a quiet hour after the owner says "go". The way back is the old DNS records, and the old app stays read-only for a week.

The runbook also lists what the forge lacks for a platform app like this, since migrate moves code only:

• a database import
• Postgres
• a file copy with a manifest
• custom domains
• per-app encrypted backups with a restore proof
• a rehearsal mode seeded from production data
• payment webhooks that survive a preview's changing address
• a read-only switch for the old side
• importing customer accounts

I did not open the child issues for those gaps; each is ready to become one. I did not touch migrate itself.

To try it, read the doc, then have a person with access to the old node do the inventory in step 1 on this issue.

🤖 Generated with Claude Code

This pull is still a runbook only: none of gretchy-stretchy's migration is done, and #11687 stays open. I opened the nine gap issues the review asked for. I ran bun scripts/gate.ts and it passed; I haven't seen the forge's check on this push.

• Gap issues: #11697 to #11705, one per gap. Each is linked to #11687 as blockedBy and ends with a Files: line.
• Runbook: docs/features/platform-app-move.md now has the matching issue number beside each bullet in "What the forge lacks", so the "each is an issue" heading is true.
• Scope: the pull is only the runbook and the filed gaps. I did not touch migrate or any code.
• Direction line: I agree it is the only justification for going ahead of the pipeline items. It stands: the owner asked for the app to survive its node going away, and the runbook is the step that lets the people with access act. A person can decide if the pull should wait.

To try it, read the runbook, then have a person with access to the old node start the inventory in step 1 on #11687.

🤖 Generated with Claude Code