fix(cd): align rollout verifier with startup budget

apps/api/tests/test_executor_network_policy_boundary.py

@@ -224,16 +224,52 @@ def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None:
     assert "workload DB identity/budget remains in progress" in workflow
 
 
-def test_cd_allows_bounded_rollout_convergence_before_boundary_verifier() -> None:
+def test_cd_bounded_rollout_budget_and_failure_terminal_receipt() -> None:
     repo_root = Path(__file__).resolve().parents[3]
     workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()
-    rollout_gate = workflow.split("# Two-replica rollouts", 1)[1].split(
-        "# AIA-P0-011:", 1
-    )[0]
+    api_deployment = next(
+        document
+        for document in yaml.safe_load_all(
+            (repo_root / "k8s/awoooi-prod/06-deployment-api.yaml").read_text()
+        )
+        if document
+        and document.get("kind") == "Deployment"
+        and document.get("metadata", {}).get("name") == "awoooi-api"
+    )
+    api_container = next(
+        container
+        for container in api_deployment["spec"]["template"]["spec"]["containers"]
+        if container["name"] == "api"
+    )
+    startup_probe = api_container["startupProbe"]
+    readiness_probe = api_container["readinessProbe"]
+    startup_budget_seconds = (
+        startup_probe["initialDelaySeconds"]
+        + startup_probe["periodSeconds"] * startup_probe["failureThreshold"]
+    )
+    readiness_budget_seconds = (
+        readiness_probe["initialDelaySeconds"]
+        + readiness_probe["periodSeconds"] * readiness_probe["failureThreshold"]
+    )
+    timeout_match = re.search(r"^\s*ROLLOUT_TIMEOUT_SECONDS=(\d+)$", workflow, re.M)
 
-    assert rollout_gate.count("--timeout=300s") == 4
-    assert "--timeout=120s" not in rollout_gate
-    assert "independent boundary verifier" in rollout_gate
+    assert timeout_match is not None
+    assert int(timeout_match.group(1)) >= (
+        startup_budget_seconds + readiness_budget_seconds + 30
+    )
+    pre_boundary_rollout = workflow.split(
+        'echo "executor_boundary_stage=collect_live_identity_and_policy"', 1
+    )[0]
+    assert "rollout status deployment/awoooi-api" not in pre_boundary_rollout
+    assert pre_boundary_rollout.count("wait_for_rollout awoooi-") == 4
+    assert "independent boundary verifier" in pre_boundary_rollout
+    assert "AWOOOI_DEPLOY_TERMINAL_RECEIPT=" in workflow
+    assert "status=${status};stage=${stage};workload=${workload}" in workflow
+    assert "source_revision=${SOURCE_REVISION}" in workflow
+    assert "workflow_run_id=${WORKFLOW_RUN_ID}" in workflow
+    assert "verifier_no_write=true" in workflow
+    assert "rollback_required=true" in workflow
+    assert "deploy verifier terminal receipt:" in workflow
 
 
 def test_broker_probe_accepts_partial_live_route_evidence(tmp_path: Path) -> None: