Phase 2.5 — Migration reconciliation checkpoint

[b5463]

Part of Milestone B — V4 Operational Core. Ref: #27

Prove that the projects world and the new systems/environments/releases/domains world describe the same running platform before deploy logic is moved.

---

Tomas tasks

Reconciliation script

• api/scripts/reconcile-v4-migration.js that verifies:
  • Every project maps to one system
  • Every mapped system has a production environment
  • Every running container maps to a release
  • Every route maps to a domain/environment
  • Every route can be regenerated without changing active output unexpectedly
  • Every encrypted env var decrypts under current ENV_SECRET
  • deploy_history rows map to releases
  • stats_history rows map to infrastructure metrics
  • Health state maps to health snapshots
  • Backup includes both legacy and V4 tables during dual mode
  • Restore can recover dual-mode state

Operator dashboard report

• Add report in Server/Admin showing:
  • Mapped projects
  • Unmapped projects
  • Orphan containers
  • Orphan routes
  • Missing domains
  • Missing releases
  • Env decryption failures
  • Backup coverage status

---

Exit gate

• Reconciliation passes on current test data
• No orphan running containers
• No unknown active routes
• Environment secrets decrypt correctly
• Backup/restore works in dual mode
• Legacy dashboard and V4 Systems API agree on counts

Rollback

Keep using legacy projects as source of truth. Disable ENABLE_V4_SYSTEMS.