docs(sre): record failed release runtime truth

docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json

@@ -2,8 +2,8 @@
   "schema_version": "sre_k3s_controlled_automation_work_items_v1",
   "governance_version": "global_product_governance_v2",
   "program_id": "AIA-SRE-P0-20260715",
-  "generated_at": "2026-07-17T02:00:46+08:00",
-  "status": "phase_3_paid_provider_first_canary_failed_safe_rollback_verified",
+  "generated_at": "2026-07-19T05:07:28+08:00",
+  "status": "phase_6_release_blocked_cd_5384_failed_runtime_unchanged",
   "scope_complete": false,
   "current_p0": {
     "id": "AIA-SRE-013",
@@ -941,14 +941,18 @@
       "confirmed_truth": [
         "the local release candidate is merged with the latest observed gitea/main and passes the CD-equivalent non-integration API gate with 5666 passed and 23 skipped, including the 977-test changed-file suite; 4 focused web tests, web typecheck and JSON/YAML parsing also pass",
         "stale Telegram tests that required unobserved OpenClaw/NemoTron/ElephantAlpha labels, a promotional check/apply/verify/writeback string or an unreceipted 88 percent confidence were replaced by no-false-AI receipt and actual stage-state contracts; receipt-backed provider, Agent99 executor, verifier and KM/MCP evidence remain visible",
-        "the Solver, RecommendedAction schema and callback registry now agree that host/systemd actions use the controlled provider and host_ansible_reconcile typed route instead of generic SSH fallback"
+        "the Solver, RecommendedAction schema and callback registry now agree that host/systemd actions use the controlled provider and host_ansible_reconcile typed route instead of generic SSH fallback",
+        "exact source SHA c0afb10861cbb76bc232fad3bbeea0d675cd9b80 was fast-forward pushed once to gitea/main and created the single CD run 5384; no empty commit, retry carrier or force push was used",
+        "CD run 5384 reached terminal Failure at 2026-07-19T05:05:37+08:00; gitea/main remained c0afb10861cbb76bc232fad3bbeea0d675cd9b80 with no deploy-marker successor",
+        "production delivery-closure readback generated at 2026-07-19T05:07:28+08:00 still reported runtime build e614f061f781c6e20a3964875d7ab3c28cf91190, so the candidate is not production-visible"
       ],
       "runtime_gaps": [
         "no program item is runtime closed for this source SHA",
         "gitea-native exact target is missing while legacy GitHub exporter runtime drift remains",
-        "local source/test readiness is complete, but no normal push, CD terminal, deploy marker, production runtime or visible UI/Telegram evidence exists for this candidate"
+        "the exact candidate has a terminal failed CD but no deploy marker, production runtime match, visible UI/Telegram receipt or same-run KM/RAG/MCP/PlayBook acknowledgement",
+        "authenticated CD logs are unavailable in this lane, so the failed step and sanitized final error remain missing; another carrier would be an unproven retry"
       ],
-      "next_action": "hand the exact local candidate SHA to the authorized release lane for one normal push after shared-writer coordination, then require terminal CD plus production API/runtime/UI/Telegram readback and exact gitea-native/legacy-exporter verification"
+      "next_action": "the CI/CD owner must capture CD 5384 failed-step evidence and either reproduce a deterministic failure locally or prove a transient runner fault before one corrected carrier; after a successful deploy marker, require production API/runtime/UI/Telegram readback plus same-run KM/RAG/MCP/PlayBook acknowledgements"
     }
   ],
   "rollups": {
@@ -965,7 +969,7 @@
     "runtime_closed_items": 0,
     "program_completion_percent": 0,
     "asset_coverage_status": "partial",
-    "runtime_closure_status": "not_started_for_this_program_sha"
+    "runtime_closure_status": "blocked_cd_5384_failure_runtime_build_e614f061f7"
   },
   "completion_contract": {
     "required_stages": [