epic(runtime): self-host deployment, migration safety and observability defects

[JSONbored]

Summary

Tracking epic for self-host runtime, deployment and observability defects from the 2026-07-27 adversarial audit, including findings from live inspection of edge-nl-01.

Sub-issues

Issue	Class
#9485 — unbounded graceful shutdown parks in-flight reviews 20–30 min	Deployment
#9486 — boot migrations take no cross-instance lock; no lock_timeout	Data integrity
#9487 — misfiring alerts, capture blind spot, gate precision, hardening	Observability / ops

Live baseline (2026-07-27, for future comparison)

• loopover-loopover-1: RestartCount=0, OOMKilled=false, 399 MiB / 2 GiB, up ~1 h (automated redeploy, not a crash).
• Postgres 3842 MB; Redis 1.64 MB / 256 MB, 1116 keys, allkeys-lru; disk 176 G / 932 G (20%).
• Queue: 25 pending, DLQ empty, no dead jobs at inspection time.
• 7-day error budget: 3 selfhost_job_dead (all lock contention — see queue: actuation-lock contention burns the retry budget and kills the job — one-shot reopen enforcement lost in production (PR #9450) #9465), 2 orb_export_failed (one 403, one timeout), 3 active_review_reconciliation_orphan_terminalized (reconciler working as designed), 1 selfhost_queue_processing_reclaimed.

That error volume is genuinely low — the defects in this audit are mostly silent ones, which is why they do not show up here.

Acceptance criteria

• All three sub-issues closed.
• A redeploy during a long AI review costs seconds of latency, not 20–30 minutes.
• Every firing alert corresponds to a real, actionable condition; no alert has been continuously red for more than a day without an owner.

[linear-code]

JSO-6552

[JSONbored]

All five child issues closed and merged (#9485, #9486, #9487, #9489, #9490). Closing the epic.