Skip to content

title: UCCA — Retirement Unit Brief — the RTOpacks residue, one reviewed unit doc_id: UCCA-RETIREMENT-UNIT-BRIEF-01 type: execution brief — converts the filed Phase-6 clearance into the reviewed retirement unit. Stop-and-report gates marked. Executes in its own window. layer: ground canonical: false ruled_by: Tim, 2026-07-03, verbatim: "rtopack retire = yes" — ruling covers the retirement unit (Q4 clearance) and the .migration-exports/ cull (rider), both resting on the same 2026-07-03 clearance. ops-v2 keep-or-cut remains an open ⟨TIM⟩ inside this brief (§4) and must be resolved before execution begins. authored: 2026-07-03 NYC (Claude-web, on Alex's step-4 filing report) relates_to: RTOPACKS-RESPONSE-MIGRATE-02-PHASE-6-01 (canon/received/ — the clearance; AUTHORITATIVE) · RTOPACKS-CORRECTION-02 (rides with it) · UCCA-CROSSING-INTAKE-PHASE-6-01 · UCCA-RTOPACKS-CLEANUP-REPORT-01 (the Tier-4 audit this closes out) · ADR-0003 (corporate boundary) executes_after: this brief executes in a dedicated window, AFTER the ⟨TIM⟩ in §4 is resolved. It does not share a window with TERRAFORM-RECONCILE; the reconcile runs after this unit completes, importing the end-state once.

Retirement Unit Brief — closing the untangle

✎ AMENDED 2026-07-03 — the unit shrinks to CODE RESIDUE ONLY. Execution waits on RTOpacks' C-6 answer. The forensic pass (UCCA-FORENSIC-RETAINED-DBS-01) + the premise correction crossed to RTOpacks (UCCA-CORRECTION-PHASE-6-PREMISE-01) establish: the "retained 450 MB rtopacks-db" was a documentation phantom (a misread ucca-backup code comment); the three DBs do not exist in e5a98302 and did not persist past the 2026-04-08 migration; .migration-exports/ is already gone. Databases + exports drop out of the unit (nothing exists to retire); the §1 gates are moot-for-data; ucca-backup comes OFF the list entirely — it is live UCCA infrastructure (backs up ops/engine/mcp), the audit had it inverted. See the amendment below (§A) for the corrected scope. Nothing crosses from here without Tim; nothing retires until RTOpacks answers C-6.

§A. Amendment — the corrected unit (2026-07-03, supersedes §1/§2 for scope)

Amendment log: amend-01 (2026-07-03, scope shrink to code residue) · amend-02 (2026-07-03, UCCA-RETIREMENT-UNIT-AMEND-02 — proxy disambiguation + guardrail, rtopacks-docs Pages added, ucca-backup-large noted; the C-6 gate is unchanged).

The retirement is code residue only. No databases, no exports, no backup worker.

  • Data (§1 gates, §2.5 exports, §2.6 databases): DROPPED. There is no retained data in e5a98302 to review or delete (forensic + correction C-1/C-5). §1's size-anomaly note and orphan-table review are moot-for-data. .migration-exports/ was deleted 2026-07-02 (local, cleanup Tier-1).
  • ucca-backup (was §2.7): REMOVED from the unit. It is live UCCA infrastructure — it backs up ops-db, engine-db, mcp-db via the D1 HTTP export API and explicitly does not touch rtopacks-db (README). The cleanup audit inverted this; it does not retire.
  • The unit is now, in full:
  • Config-only workers — stats-cache, cricos-sync (not deployed, RTO-domain). Retire.
  • qual-enrichment — released by RTOPACKS-CORRECTION-02 §C-3, no export requested. Retire.
  • RTOpacks proxies (exact names only) — rtopacks-docs-proxy and rtopacks-proxy (both not deployed, REPORT-01 Unit D): verify RTOpacks' repoint is live from the public side, then retire. ⚠ GUARDRAIL (amend-02, Tim ruled 2026-07-03): match on the exact worker names, NEVER a substring. UCCA's own docs-proxy and knowledge-proxy are live UCCA infrastructure (they serve docs/knowledge.ucca.online) — permanently OUT of retirement scope. Do NOT retire them.
  • ops-v2 / ucca-ops — CUT (ruled §4) with its dangling rtopacks-db bindings (19 call sites, pointing at a DB that no longer exists). Its world UI/API (app/w/catalog/worlds/, lib/worlds/rtopacks/) dies with this cut — no separate entry needed.
  • rtopacks-docs Pages project (amend-02, new in REPORT-01) — RTOpacks residue Pages project; retire on execution, same treatment as the rest of the list.
  • NEW — coordinate, do NOT unilaterally retire: a lingering Pages custom-hostname trust.rtopacks.com.au on rtopacks-trust.pages.dev (auto-renewing certs in e5a98302 since the migration). It touches RTOpacks' domain — handle with the client, not as a unilateral retire. Recorded in the correction crossing C-5.
  • Noted, NOT in scope (amend-02): ucca-backup-large Worker — deployed but SUSPENDED 2026-04-09 (UCCA-CLEANUP-01; cron disabled, no databases in scope). It is UCCA-named infra; its disposition is a UCCA-side housekeeping pass, not the RTOpacks retirement. Recorded so the execution window does not rediscover it. Corroboration: that 2026-04-09 removal of the cross-account export pattern is consistent with the forensic — the DBs left at the 2026-04-08 migration, no later deletion (UCCA-FORENSIC-RETAINED-DBS-01, carried in UCCA-CORRECTION-PHASE-6-PREMISE-01; nothing new crosses).
  • Engine-repo fossil worlds — OUT of scope: worlds/usa_for_later/ and the mis-filed worlds/moodle/ connector are CANON-CULL / cleanup-lane candidates (yellow-tape + ledger), never touched by this retirement pass.
  • Unchanged exclusions: all rtopacks.com.au zone/DNS/storage (separate handover). f95d4537 never touched.
  • Execution gate: waits on RTOpacks' C-6 answer — whether their Q4 clearance stands given the corrected premise (now covering code residue + the hostname coordination). One-line confirm → proceed.

What this is. MIGRATE-02's Phase 6, finally. The clearance is granted, corrected, filed, and verified (canon/received/). This brief converts it into one reviewed unit. The documents in canon/received/ are authoritative; where this brief and they conflict, they win.

0. Standing constraints (read before anything)

  • Account: everything in this brief lives in the UCCA account (e5a98302). The RTOpacks account (f95d4537) is not touched — and note BOTH client-pointing default credentials on Tim's side: the machine's wrangler OAuth (defusing by logout) and the Claude-app Cloudflare connector (permanently client-bound; never used). Every command in this brief sources the UCCA token explicitly, as the deploy did.
  • Hard exclusion (their condition 1): no rtopacks.com.au zone / DNS / storage resource retires in this unit. Live zone authority is UCCA-side Terraform; it transfers under a separate deliberate handover, their queue. If any retirement step would touch a zone resource, that step stops.
  • One reviewed unit: every deletion in this brief is listed, reviewed against the clearance, then executed in sequence. No opportunistic extras.
  • ucca-backup retires LAST. It is the live safety net until the moment the databases it backs up are gone.

1. Pre-deletion tasks (both BEFORE any retirement step; stop-gates)

§1 RAN read-only 2026-07-03 → STOP-AND-REPORT (UCCA-RETIREMENT-GATE-1-REPORT-01). Both gates' subjects are already gone: the three retained DBs (rtopacks-db 334ac8fb, rto-nrt-db, abs-db) do not exist in e5a98302 (verified by d1 list + direct lookup), and .migration-exports/ was deleted under cleanup-recon Tier-1. The size-anomaly note is moot; the orphan-table review is unrunnable (no tables to enumerate). What remains is code residue only (dangling rtopacks-db bindings in ops-v2 + workers/backup — §2, data-safe). One record discrepancy escalated: RTOpacks' Q2 believes the retained copies are extant; they are not, and the pre-deletion safety review never ran against them. Nothing retired.

  1. The size-anomaly note (their condition 3). Record in this unit's retirement record: retained rtopacks-db measures ~450 MB; the migration source on their record was 3.13 GB (2026-02-28) and their successor is 2.94 GB. The retained copy is likely a partial or earlier snapshot. Their completeness case does not rest on it; ours notes it before deletion.
  2. The absorbed-nowhere review (their honest limit 2). Read-only pass over the three retained DBs (rtopacks-db, rto-nrt-db, abs-db copies): enumerate tables, check each has a successor equivalent per the Q2 table (successor UUIDs 1249760d-… and 0a78dd86-…, their side). Gate: any table with no successor equivalent STOPS the unit — it becomes a crossing (raise → RTOpacks adjudicates → answered copy filed) before any deletion proceeds. Report the review's findings either way.

2. The unit (retire in this order, each step verified before the next)

  1. Five config-only workers (the audit's retire-candidates — config exists, not deployed). Lowest risk first.
  2. qual-enrichment — explicitly released by CORRECTION-02 §C-3, no source export requested, no conditions.
  3. rtopacks-docs-proxy (and its round-union-555d subdomain surface) — their repoint is confirmed (relayed 2026-07-03, recorded in the intake note §2). Verify the repoint is live from the public side (their docs URL no longer resolves through our worker) before retiring — verify, then believe.
  4. ops-v2 / ucca-ops — CUT (ruled 2026-07-03, §4). Retires here with its rtopacks-db bindings (19 call sites). No KEEP unbinding path needed.
  5. The 21 GB .migration-exports/ directory, NRT chunks included — full deletion per the rider's green light. Nothing parked, nothing retained.
  6. The three retained databases (rtopacks-db, rto-nrt-db, abs-db UCCA-account copies) — only after steps 1–5 verified and §1's gates passed.
  7. ucca-backup — last, after the databases it serviced are gone.

3. Discipline per step

  • Verify-before-verdict: read the resource's live state before touching it.
  • Log every retirement (resource, ID, timestamp, clearance reference) in the unit's retirement record — this record is what makes the unit "reviewed."
  • Record every infra delta for TERRAFORM-RECONCILE in the same pass; the reconcile runs once, after this unit, importing the end-state.
  • Stop-and-report on ANY surprise: an unexpected binding, a resource serving traffic, a name that doesn't match the audit. The cleanup brief's gates prevented two breakages; this unit inherits them.

4. ⟨TIM⟩ — RESOLVED 2026-07-03: CUT

RULED (Tim, 2026-07-03): ops-v2 / ucca-ops = CUT. RTOpacks confirmed no reliance (Q3); the call was purely UCCA-facing and the engine does not keep a standalone admin panel in this unit. ops-v2 retires as §2.4 (its rtopacks-db bindings — 19 call sites — go with it; no KEEP unbinding path is needed). The §4 execution blocker is cleared: all seven §2 steps are now in scope, subject only to the §1 pre-deletion gates.

Original ⟨TIM⟩ (for the record): ops-v2 / ucca-ops: KEEP or CUT. RTOpacks confirmed no reliance (Q3). The question was purely UCCA-facing: does the engine want an admin panel of its own going forward (KEEP — re-scope brief follows), or not (CUT — retires in §2.4)? If undecided at execution time, the default was DEFER-with-trigger: steps 1–3 and 5 may proceed; steps 4/6/7 wait, because a kept ops-v2 must be unbound from rtopacks-db before that DB can go.

5. Grades of done (for the executing window)

  • Full: §1 both passed · §2 all seven steps · retirement record complete · deltas logged · RTOpacks notified the unit is closed (one-line, Tim carries).
  • Good: §1 passed + §2 steps 1–5, stopped clean before the databases.
  • Floor: §1 passed (both gates), unit untouched — an honest review that found a stopper is a floor met, not a failure.

Attached materials

  • UCCA-RETIREMENT-UNIT-BRIEF-01--backup-removal-candidate-2026-07-10.patch (this directory) — candidate content for the final (backup-removal) step — authored 2026-04-09 pre-clearance, uncommitted 92 days; re-verify against HEAD before use. It is a git diff of the three infra/ucca-infra/scripts/backup/ scripts (cf-backup.sh, cf-restore.sh, cf-verify.sh) removing rtopacks-db from the UCCA-side backup rotation. Found as a migration-day orphan in the ucca-infra working tree (2026-07-10); the working files were restored to HEAD and the diff filed here rather than committed. Bytes/provenance recorded in fossil-ledger.md (2026-07-10 row). Maps to §2 step 7 (ucca-backup, last). Retires nothing on its own — execution stays gated on RTOpacks C-6.

The untangle's last mile. Cleared by their words, corrected by their bytes, ruled by Tim's. One unit, reviewed, backup last, zone untouched, any orphan table stops the world. Then the engine account holds only the engine.