docs: record actual IndeeHub worker shutdown qualification

docs/SESSION-HANDOVER-20261007.md

@@ -39,9 +39,16 @@ Read **Current live checkpoint** first. Older receipts below apply only to their
   image9b3ef4116d4b998820e25e09eda7ca14f23e9e264158629451b81e32b47d9c8e,
   OCI SHA2566db29188c0e68ed8e9e8d84ea2e9c5c70695518e0930775bf6b3200d14d99527.
   All474 frozen tracked inputs stayed unchanged; both Node stages were pinned
-  to a verified cached digest. Actual disposable worker/Redis shutdown checks,
-  scoped live import, reviewed catalog pin/signature and delivery remain open.
-  No image import, deployment or publication occurred.
+  to a verified cached digest. Actual isolated image runtime shutdown checks now
+  pass: idle SIGTERM exits 0; an active download survives SIGTERM then SIGINT,
+  finishes HLS uploads and one database key/content commit after release, exits
+  0, and leaves the second queued job waiting. Alpine 3.23.4 / FFmpeg 8.0.1 /
+  Node 20.20.2. All five synthetic fixture containers are stopped; network-none,
+  no host ports or live data mounts. Cold synthetic database setup failures are
+  retained and are not PostgreSQL startup/recovery acceptance. Detailed receipt:
+  `docs/indeehub-worker-runtime-20261008.md`.
+  Scoped live import, reviewed catalog pin/signature and delivery remain open.
+  No live image import, deployment or publication occurred.
 - Live dev/Yaya dashboard index remains
   `92050cbda69954f57f4b0bdd73d89623f6aae9fc66e4c074ee4f46bdcb9c3b2a`.
   Final Fleet UI artifact **is built**, not deployed: archive

docs/indeehub-worker-runtime-20261008.md

@@ -0,0 +1,47 @@
+# IndeeHub worker image runtime qualification — 2026-10-08
+
+Status: isolated actual-image shutdown qualification passed; live delivery remains open.
+
+Source: `29627fc3a316316e5f75fe799218ff41a2a0dea8`.
+Image: `9b3ef4116d4b998820e25e09eda7ca14f23e9e264158629451b81e32b47d9c8e`.
+OCI archive SHA256: `6db29188c0e68ed8e9e8d84ea2e9c5c70695518e0930775bf6b3200d14d99527`.
+Manifest: `sha256:b17a140356f3c78204668aa385bd1d7bae2c946ac85cc0688e650f618a19fbfa`.
+
+The built image ran its unchanged production worker command against synthetic
+Redis, PostgreSQL tables and a minimal S3 HTTP fixture in a shared network-none
+namespace. No host ports, real credentials, live data mounts or payments were
+used. The fixture generated one second of blue video and audio.
+
+- Idle worker received SIGTERM and exited 0.
+- Active job download was held open. SIGTERM followed by SIGINT did not terminate
+  it prematurely. After release it uploaded a 220-byte HLS manifest and a
+  19,744-byte encrypted segment, stored exactly one content key and marked the
+  first content completed. Worker exited 0.
+- The queued successor remained waiting and its content remained pending.
+- Installed runtime: Alpine 3.23.4, FFmpeg 8.0.1, Node 20.20.2.
+- All five owned fixture containers were confirmed stopped. The exact container
+  IDs, image identities, namespaces and volume boundaries are retained.
+
+Cold fixture database initialization exceeded the original 90-second harness
+allowance. Stopping during initialization left a valid cluster without the
+requested dummy database. The next failed setup receipt is also retained. The
+missing synthetic database was explicitly created before worker tests; the
+harness allowance became 300 seconds. This is fixture setup, not PostgreSQL
+startup or recovery acceptance. No production deadline changed.
+
+Evidence directory:
+`~/.local/state/archipelago/release-qualification/worker-runtime-29627fc-20261008/`
+
+It contains runtime-receipt.json, qualification-boundary.json, both setup failure
+receipts, image-source.json, container logs, and exact hashed Python/JavaScript
+harnesses. Redis/PostgreSQL were selected from the retained legacy-images.tar;
+their config SHA256 and every uncompressed layer digest were verified before
+loading into the separate private build store. The original worker build receipt
+still records runtimeQualified=false at build time; this later receipt records
+the additional evidence without rewriting history.
+
+This qualifies shutdown with real BullMQ/Redis, PostgreSQL and FFmpeg on synthetic
+media. It does not qualify real MinIO behavior, deployment, production migration,
+full-length media, producer payments, timed rentals or discovery. Scoped Yaya
+image import and reviewed signed catalog inclusion remain gated by the IndeeHub
+cutover/recovery acceptance work. No live image import or publication occurred.