# RALPLAN-DR Revision 5: Final Deployment Corrections

Revision 4 remains the complete execution plan. The following corrections supersede its conflicting lines and close the final review findings.

## Loopback console cookie
- Plain HTTP at `127.0.0.1:9120` uses a bare cookie name `physique_coach_console`, not an `__Host-` cookie.
- Attributes: HttpOnly, SameSite=Strict, Path=/, no Domain. `Secure` is false only for loopback HTTP; non-loopback startup remains forbidden.
- A real Playwright/browser test over loopback verifies persistence, rotation, idle expiry and replay denial. Route-only tests are not sufficient.

## Isolated service ownership
- Never run `hermes dashboard --stop`; it can terminate unrelated dashboards.
- Lifecycle operations target only `physique-coach-dashboard.service` through `systemctl --user stop|start|restart|disable`.
- Port 9120 conflict causes startup failure and launch block. Diagnosis may inspect the port owner, but automation refuses to kill any process not proven to be the systemd MainPID of this unit.

## Correct frontend artifact
- Vite output and reviewed service artifact are `/home/cube/projects/richard/hermes-agent/hermes_cli/web_dist`.
- Before `--skip-build` restart, require:
```bash
cd /home/cube/projects/richard/hermes-agent
/home/cube/.local/bin/npm --workspace web run typecheck
/home/cube/.local/bin/npm --workspace web run build
/home/cube/projects/richard/hermes-agent/venv/bin/python - <<'PY'
from pathlib import Path
root=Path('/home/cube/projects/richard/hermes-agent/hermes_cli/web_dist')
assert (root/'index.html').is_file()
assert any(p.is_file() for p in (root/'assets').iterdir())
PY
```
- Failure blocks dashboard restart.

## Real-Telegram E2E isolation
- Register marker `e2e: uses dedicated external test credentials; never selected by default` in `/home/cube/projects/richard/hermes-agent/pyproject.toml`.
- Default full suite excludes it through the project test configuration or an explicit `-m 'not e2e'`; explicit E2E requires dedicated test token/chat/topic preflight and refuses production/customer identifiers.
- Test file: `tests/e2e/test_physique_coach_pilot.py`.

## Profile-root ownership
- `HERMES_HOME` is the canonical runtime profile root.
- `dashboard.physique_coach_profile_root` is only an expected-root allowlist value. Adapter resolves from `HERMES_HOME`, canonicalizes both paths, and requires exact equality; it never chooses a different root from config.

## Safe live health probe
- New script: `/home/cube/projects/richard/hermes-agent/scripts/probe_physique_coach_dashboard.py`.
- It obtains the launch bearer only from the root-readable/private systemd runtime environment or a mode-0600 runtime token file created by the dashboard unit; it never prints or persists the token in the receipt.
- It calls loopback `POST /api/physique-coach/session/bootstrap`, retains the returned console cookie/CSRF in memory, then calls `GET /api/physique-coach/health`.
- Exit 0 only when HTTP 200, profile=`physique-coach`, capability compatible, registry loaded, worker heartbeat age<10s, no stale sending; otherwise nonzero with redacted reason.
- Exact rollout gate:
```bash
cd /home/cube/projects/richard/hermes-agent
systemctl --user is-active physique-coach-gateway.service physique-coach-dashboard.service
/home/cube/projects/richard/hermes-agent/venv/bin/python scripts/probe_physique_coach_dashboard.py --base-url http://127.0.0.1:9120
```

## Exact rehearsal commands
```bash
# Dedicated test-account E2E; cwd Hermes repo
cd /home/cube/projects/richard/hermes-agent
/home/cube/projects/richard/hermes-agent/venv/bin/python -m pytest tests/e2e/test_physique_coach_pilot.py -m e2e

# Gateway crash/concurrency fault suite; cwd Hermes repo
/home/cube/projects/richard/hermes-agent/venv/bin/python -m pytest tests/gateway/test_customer_outbound_worker.py -k 'crash or timeout or concurrent'

# Profile backup/restore/tombstone; cwd profile package
cd /home/cube/.hermes/profiles/physique-coach/workspace/checkin_cli
/home/cube/projects/richard/hermes-agent/venv/bin/python -m pytest tests/test_customer_privacy.py -k 'backup or restore or tombstone'
```
- Receipt records cwd, absolute argv, exit code, duration, code version, capability generation and redacted result.

## Final execution order
1. Apply Revision 3 phases and Revision 4 atomic/session/lifecycle contracts with these corrections.
2. Build and verify `hermes_cli/web_dist`.
3. Install/restart only the two named profile services with flags off.
4. Require both `systemctl is-active` and the safe live probe.
5. Run focused/full profile, Hermes and frontend tests; run E2E/fault/restore rehearsals with exact commands.
6. Rotate token and complete activation receipts before enabling the test customer, then the real pilot.

## ADR Amendment
Loopback HTTP intentionally uses a bare strict HttpOnly cookie, isolated unit operations never invoke the global dashboard stop command, the served artifact is `hermes_cli/web_dist`, and external E2E is strictly marked/credential-gated.

## Intent Reconciliation
No user-facing scope or deep-interview decision changes.