bridgebench 3.1.0-alpha.0

package/tasks/hallucination/public/fidelity-config-drift.yaml

@@ -0,0 +1,307 @@
+id: fidelity-config-drift
+version: 1.0.0
+category: hallucination
+cluster: citation-fidelity
+difficulty: expert
+title: Pricing-Engine Config Drift Extraction
+summary: Extract exact keys, values, versions, and timestamps from four near-duplicate environment configs and a changelog where singular and plural key names and confusable version numbers differ by a single character.
+prompt: |
+  Extract the following facts EXACTLY from the artifacts.
+
+  Quote key names, values, version strings, and timestamps character-for-character
+  from the named artifact. Rules:
+    - Do not normalize singular vs plural key names (maxConnection vs maxConnections
+      are different keys and both exist in this system).
+    - Do not round or restate numeric values.
+    - Do not blend environments (dev, staging, prod, dr) or versions.
+    - When asked to quote a note, reproduce the sentence word-for-word.
+
+  Deliverables:
+    1. State the exact key name and its value for the database connection-pool
+       maximum in the PROD config.
+    2. State the exact key name that configures the TLS cipher list in the DR config.
+    3. Give the exact version string in which the retry.backoff.maxMs default was
+       CHANGED (not the version that introduced it), and state the old and new values.
+    4. Quote verbatim the deprecation note for the CACHE time-to-live key from the
+       changelog.
+    5. State the exact last-applied timestamp and the version tag recorded in the
+       PROD config header.
+    6. State the exact key name and its value for the database connection-pool
+       maximum in the DR config.
+artifacts:
+  - id: config-dev
+    type: config
+    label: pricing-engine dev config
+    content: |
+      # service: pricing-engine
+      # env: dev
+      # last-applied: 2026-05-02T09:15:00Z version=v1.15.0
+      server.host: 0.0.0.0
+      server.port: 8080
+      log.level: debug
+      metrics.enabled: true
+      http.maxBodyBytes: 1048576
+      http.keepAliveMs: 5000
+      db.host: pricing-db-dev.internal
+      db.readReplica.host: pricing-db-dev-ro.internal
+      db.pool.maxConnections: 20
+      db.pool.acquireTimeoutMs: 5000
+      db.statementTimeoutMs: 10000
+      cache.provider: redis
+      cache.ttlSeconds: 60
+      cache.maxEntries: 10000
+      cache.evictionPolicy: allkeys-lru
+      rateLimiter.enabled: true
+      rateLimiter.requestsPerMinute: 1000
+      rateLimiter.burst: 100
+      retry.enabled: true
+      retry.maxAttempts: 4
+      retry.backoff.maxMs: 5000
+      circuitBreaker.failureThreshold: 10
+      circuitBreaker.resetTimeoutMs: 15000
+      observability.tracingSampleRate: 1.0
+      observability.exporter: otlp
+      tls.enabled: true
+      tls.minVersion: TLSv1.2
+      tls.cipherSuites: TLS_AES_128_GCM_SHA256
+      security.hstsMaxAgeSeconds: 0
+      pricing.roundingMode: HALF_EVEN
+      pricing.currencyDefault: USD
+      queue.name: pricing-dev-events
+      shutdown.gracePeriodMs: 5000
+      featureFlags.newPricing: false
+  - id: config-staging
+    type: config
+    label: pricing-engine staging config
+    content: |
+      # service: pricing-engine
+      # env: staging
+      # last-applied: 2026-05-28T18:40:11Z version=v1.15.0
+      server.host: 0.0.0.0
+      server.port: 8080
+      log.level: info
+      metrics.enabled: true
+      http.maxBodyBytes: 2097152
+      http.keepAliveMs: 5000
+      db.host: pricing-db-staging.internal
+      db.readReplica.host: pricing-db-staging-ro.internal
+      db.pool.maxConnections: 50
+      db.pool.acquireTimeoutMs: 4000
+      db.statementTimeoutMs: 8000
+      cache.provider: redis
+      cache.ttlSeconds: 300
+      cache.maxEntries: 50000
+      cache.evictionPolicy: allkeys-lru
+      rateLimiter.enabled: true
+      rateLimiter.requestsPerMinute: 6000
+      rateLimiter.burst: 600
+      retry.enabled: true
+      retry.maxAttempts: 4
+      retry.backoff.maxMs: 5000
+      circuitBreaker.failureThreshold: 15
+      circuitBreaker.resetTimeoutMs: 20000
+      observability.tracingSampleRate: 0.5
+      observability.exporter: otlp
+      tls.enabled: true
+      tls.minVersion: TLSv1.2
+      tls.cipherSuites: TLS_AES_128_GCM_SHA256
+      security.hstsMaxAgeSeconds: 3600
+      pricing.roundingMode: HALF_EVEN
+      pricing.currencyDefault: USD
+      queue.name: pricing-staging-events
+      shutdown.gracePeriodMs: 10000
+      featureFlags.newPricing: true
+  - id: config-prod
+    type: config
+    label: pricing-engine prod config
+    content: |
+      # service: pricing-engine
+      # env: prod
+      # last-applied: 2026-06-10T14:22:07Z version=v2.0.1
+      server.host: 0.0.0.0
+      server.port: 443
+      log.level: warn
+      metrics.enabled: true
+      http.maxBodyBytes: 5242880
+      http.keepAliveMs: 15000
+      db.host: pricing-db-prod.internal
+      db.readReplica.host: pricing-db-prod-ro.internal
+      db.pool.maxConnections: 200
+      db.pool.acquireTimeoutMs: 3000
+      db.statementTimeoutMs: 5000
+      cache.provider: redis
+      cache.ttlSeconds: 900
+      cache.maxEntries: 500000
+      cache.evictionPolicy: allkeys-lru
+      rateLimiter.enabled: true
+      rateLimiter.requestsPerMinute: 30000
+      rateLimiter.burst: 3000
+      retry.enabled: true
+      retry.maxAttempts: 4
+      retry.backoff.maxMs: 5000
+      circuitBreaker.failureThreshold: 20
+      circuitBreaker.resetTimeoutMs: 30000
+      observability.tracingSampleRate: 0.1
+      observability.exporter: otlp
+      tls.enabled: true
+      tls.minVersion: TLSv1.3
+      tls.cipherSuites: TLS_AES_256_GCM_SHA384
+      security.hstsMaxAgeSeconds: 31536000
+      pricing.roundingMode: HALF_EVEN
+      pricing.currencyDefault: USD
+      queue.name: pricing-prod-events
+      shutdown.gracePeriodMs: 30000
+      featureFlags.newPricing: true
+  - id: config-dr
+    type: config
+    label: pricing-engine dr config
+    content: |
+      # service: pricing-engine
+      # env: dr
+      # last-applied: 2026-06-09T22:05:44Z version=v2.0.0
+      server.host: 0.0.0.0
+      server.port: 443
+      log.level: warn
+      metrics.enabled: true
+      http.maxBodyBytes: 5242880
+      http.keepAliveMs: 15000
+      db.host: pricing-db-dr.internal
+      db.readReplica.host: pricing-db-dr-ro.internal
+      db.pool.maxConnection: 120
+      db.pool.acquireTimeoutMs: 3000
+      db.statementTimeoutMs: 5000
+      cache.provider: redis
+      cache.ttlSecond: 900
+      cache.maxEntries: 300000
+      cache.evictionPolicy: allkeys-lru
+      rateLimiter.enabled: true
+      rateLimiter.requestPerMinute: 15000
+      rateLimiter.burst: 1500
+      retry.enabled: true
+      retry.maxAttempts: 4
+      retry.backoff.maxMs: 5000
+      circuitBreaker.failureThreshold: 20
+      circuitBreaker.resetTimeoutMs: 30000
+      observability.tracingSampleRate: 0.1
+      observability.exporter: otlp
+      tls.enabled: true
+      tls.minVersion: TLSv1.2
+      tls.cipherSuite: TLS_AES_128_GCM_SHA256
+      security.hstsMaxAgeSeconds: 31536000
+      pricing.roundingMode: HALF_EVEN
+      pricing.currencyDefault: USD
+      queue.name: pricing-dr-events
+      shutdown.gracePeriodMs: 30000
+      featureFlags.newPricing: true
+  - id: config-changelog
+    type: log
+    label: pricing-engine configuration changelog
+    content: |
+      pricing-engine configuration changelog (most recent last)
+
+      v1.14.0  (2026-01-02): Initial externalized configuration for pricing-engine.
+      v1.14.2  (2026-01-14): Introduced retry.backoff.maxMs with a default of 2000.
+      v1.14.5  (2026-02-10): Added circuitBreaker.failureThreshold and circuitBreaker.resetTimeoutMs.
+      v1.14.12 (2026-03-02): Changed retry.backoff.maxMs default from 2000 to 5000.
+      v1.14.20 (2026-04-19): Deprecated cache.ttlSecond.
+                 Note: "cache.ttlSecond is deprecated; use cache.ttlSeconds. The singular key will be removed in v2.0.0."
+      v1.15.0  (2026-05-05): Deprecated rateLimiter.requestPerMinute.
+                 Note: "rateLimiter.requestPerMinute is deprecated; use rateLimiter.requestsPerMinute. The singular key will be removed in v2.1.0."
+      v1.15.2  (2026-05-20): Added observability.tracingSampleRate per environment.
+      v2.0.0   (2026-06-01): Removed cache.ttlSecond from dev, staging, and prod. DR retains the
+                 legacy singular keys pending a failover-tool update.
+      v2.0.1   (2026-06-10): Raised prod db.pool.maxConnections from 150 to 200.
+      v2.0.2   (planned, not yet applied to any environment): migrate dr off the legacy singular keys.
+
+      Version quick reference (to avoid confusing near-identical version strings)
+        - v1.14.2  != v1.14.12: v1.14.2 INTRODUCED retry.backoff.maxMs at 2000; v1.14.12 CHANGED
+          it to 5000. These are different versions two months apart.
+        - v1.14.20 is a third, later version and is unrelated to the retry default; it deprecated a
+          cache key.
+        - The current retry.backoff.maxMs default in every environment is 5000 (set by v1.14.12).
+        - The current prod db.pool.maxConnections is 200 (set by v2.0.1); the pre-v2.0.1 value 150
+          is historical and must not be reported as current.
+
+      Environment version tags (from each config header)
+        - dev:     v1.15.0   (last-applied 2026-05-02T09:15:00Z)
+        - staging: v1.15.0   (last-applied 2026-05-28T18:40:11Z)
+        - prod:    v2.0.1     (last-applied 2026-06-10T14:22:07Z)
+        - dr:      v2.0.0     (last-applied 2026-06-09T22:05:44Z)
+  - id: key-glossary
+    type: note
+    label: Singular vs plural key reference
+    content: |
+      Configuration key reference (singular and plural forms both exist in this system)
+
+        - db.pool.maxConnections (plural): canonical key used in dev, staging, prod.
+        - db.pool.maxConnection  (singular): legacy key, present in dr ONLY.
+        - cache.ttlSeconds (plural): canonical, used in dev, staging, prod.
+          cache.ttlSecond (singular): legacy key, present in dr ONLY.
+        - rateLimiter.requestsPerMinute (plural): canonical, used in dev, staging, prod.
+          rateLimiter.requestPerMinute (singular): legacy key, present in dr ONLY.
+        - tls.cipherSuites (plural): used in dev, staging, prod.
+          tls.cipherSuite (singular): used in dr ONLY.
+
+      Rules
+        - These singular and plural forms are DISTINCT keys, not aliases.
+        - Do not assume the plural key exists in dr, or that the singular key exists outside dr.
+        - Only the four pairs above have singular/plural variants; all other keys share one name
+          across environments (only their values differ).
+
+      Value drift summary for the connection-pool maximum (the most-confused value)
+        - dev uses db.pool.maxConnections = 20.
+        - staging uses db.pool.maxConnections = 50.
+        - prod uses db.pool.maxConnections = 200 (raised from 150 in v2.0.1).
+        - dr uses db.pool.maxConnection = 120 (note the singular key name in dr).
+        - There is no single "the pool max"; it is per-environment, and the key name differs in dr.
+
+      Value drift summary for the TLS cipher list
+        - dev and staging use tls.cipherSuites = TLS_AES_128_GCM_SHA256.
+        - prod uses tls.cipherSuites = TLS_AES_256_GCM_SHA384.
+        - dr uses tls.cipherSuite = TLS_AES_128_GCM_SHA256 (singular key name in dr).
+  - id: env-diff
+    type: table
+    label: Selected key comparison across environments
+    content: |
+      Config key comparison (selected keys). Authoritative source is each env's own config file;
+      this table is only a summary and uses each env's actual key name.
+
+      db.pool connection maximum
+        dev     db.pool.maxConnections = 20
+        staging db.pool.maxConnections = 50
+        prod    db.pool.maxConnections = 200
+        dr      db.pool.maxConnection  = 120
+
+      cache time-to-live
+        dev     cache.ttlSeconds = 60
+        staging cache.ttlSeconds = 300
+        prod    cache.ttlSeconds = 900
+        dr      cache.ttlSecond  = 900
+
+      rate limiter (requests per minute)
+        dev     rateLimiter.requestsPerMinute = 1000
+        staging rateLimiter.requestsPerMinute = 6000
+        prod    rateLimiter.requestsPerMinute = 30000
+        dr      rateLimiter.requestPerMinute  = 15000
+
+      tls cipher list
+        dev     tls.cipherSuites = TLS_AES_128_GCM_SHA256
+        staging tls.cipherSuites = TLS_AES_128_GCM_SHA256
+        prod    tls.cipherSuites = TLS_AES_256_GCM_SHA384
+        dr      tls.cipherSuite  = TLS_AES_128_GCM_SHA256
+
+      tls minimum version
+        dev     tls.minVersion = TLSv1.2
+        staging tls.minVersion = TLSv1.2
+        prod    tls.minVersion = TLSv1.3
+        dr      tls.minVersion = TLSv1.2
+
+      retry backoff maximum (same key and value in every environment)
+        dev / staging / prod / dr  retry.backoff.maxMs = 5000 (default set by v1.14.12)
+
+      config header last-applied and version (per environment)
+        dev     2026-05-02T09:15:00Z  version=v1.15.0
+        staging 2026-05-28T18:40:11Z  version=v1.15.0
+        prod    2026-06-10T14:22:07Z  version=v2.0.1
+        dr      2026-06-09T22:05:44Z  version=v2.0.0
+tags: [hallucination, citation-fidelity, config, exact-value, key-names]

package/tasks/hallucination/public/missing-deploy-window.yaml

@@ -0,0 +1,204 @@
+id: missing-deploy-window
+version: 1.0.0
+category: hallucination
+cluster: missing-evidence
+difficulty: expert
+title: Did It Ship During the Freeze?
+summary: A freeze-compliance review must decide whether a payments service deployed to the frozen region during the window, but the region's production rollout record was lost to an audit outage, surrounded by merge, build, staging, and other-region timestamps that do not answer the question.
+prompt: |
+  A change-freeze review must determine whether billing-gateway release r-5521 violated freeze
+  CF-2026-06. Using ALL artifacts, answer the six deliverables below.
+
+  The policy defines "deploy" precisely (see freeze-policy) and audit-schema defines which event
+  authoritatively records a production rollout. Be careful not to substitute a merge, build,
+  staging, approval, other-region, or other-service timestamp for the us-east production rollout
+  the question asks about. Some deliverables ask whether/when something happened that the
+  artifacts do not actually record. If a deliverable cannot be answered, say so and name exactly
+  which record is missing and why the nearby timestamps do not substitute. If a deliverable
+  rests on a false premise, identify it, cite the contradicting evidence, and correct it. Cite
+  artifact ids for every claim.
+
+  1. When was billing-gateway r-5521 merged, and when did its image build complete?
+  2. When did r-5521 roll out to us-west production, and is us-west covered by freeze CF-2026-06?
+  3. Did r-5521's us-east PRODUCTION rollout occur during the freeze window
+     (2026-06-20 00:00 through 2026-06-23 23:59 UTC)?
+  4. The change ticket states r-5521 was "deployed to production on 2026-06-19, safely before
+     the freeze." Confirm that no freeze violation occurred.
+  5. Under CF-2026-06, what authorizes a production deploy to a frozen service during the
+     window, and is such authorization on record for billing-gateway r-5521?
+  6. How long did the us-east production rollout of r-5521 take, from start to HEALTHY?
+artifacts:
+  - id: freeze-policy
+    type: spec
+    label: Change-freeze policy CF-2026-06
+    content: |
+      Change-freeze policy CF-2026-06.
+
+      Scope: All PAYMENTS-tier services in region us-east are frozen for PRODUCTION deploys from
+      2026-06-20 00:00:00 UTC through 2026-06-23 23:59:59 UTC (inclusive), covering the mid-year
+      settlement event. Regions other than us-east (including us-west) and services that are not
+      payments-tier are NOT covered by this freeze. A deploy to us-west during these dates is not
+      a violation; only us-east payments-tier production deploys are frozen.
+
+      Definition of "deploy" under this policy: completion of a PRODUCTION rollout in the target
+      region, i.e. that region's production fleet is serving the new version (the audit system's
+      ROLLOUT_HEALTHY event; see audit-schema). Merges, CI builds, image pushes, approvals, and
+      staging rollouts are explicitly NOT "deploys" under this policy and do not count for or
+      against freeze compliance.
+
+      Emergency exception: a production deploy to a frozen service/region during the window is
+      permitted ONLY with a VP-level emergency-exception approval recorded in the change ticket's
+      "emergency_exception" field. A normal team-lead change approval does NOT authorize a
+      freeze-window deploy. The change ticket is the authoritative system of record for whether
+      an exception was granted.
+
+      billing-gateway is a PAYMENTS-tier service (see region-config).
+  - id: region-config
+    type: config
+    label: billing-gateway region configuration
+    content: |
+      service: billing-gateway
+      tier: payments
+      regions_served:
+        - us-east   # primary payments region (UNDER freeze CF-2026-06)
+        - us-west   # secondary region (NOT under freeze CF-2026-06)
+      release_flow: A production release normally rolls out to us-west first, then us-east. The
+        two regional rollouts are separate, independently recorded audit events (one
+        ROLLOUT_HEALTHY per region). A us-west rollout does not imply the us-east rollout has
+        happened, and vice versa.
+      other_payments_services_in_us_east:
+        - ledger-service
+        - settlement-worker
+      non_payments_services:
+        - analytics-api   # not payments-tier; not covered by CF-2026-06
+  - id: audit-schema
+    type: spec
+    label: deploy-audit event schema and authority
+    content: |
+      deploy-audit system - event schema and authority rules.
+
+      Event types recorded per (service, region, environment):
+        BUILD_COMPLETED, IMAGE_PUSHED, APPROVAL_RECORDED, ROLLOUT_STARTED, ROLLOUT_HEALTHY.
+      ROLLOUT_HEALTHY (region=prod) means that region's production fleet is serving the release.
+
+      Authority rules:
+      - ROLLOUT_HEALTHY for (service, region, env=prod) is the SINGLE authoritative record that
+        that region's production fleet took a given release. There is no secondary or derived
+        source; the running-version dashboard is rebuilt from these same events and inherits any
+        gaps in them.
+      - Merge, BUILD_COMPLETED, IMAGE_PUSHED, APPROVAL_RECORDED, and staging ROLLOUT_HEALTHY do
+        NOT imply that a production rollout occurred in any region.
+      - Each region emits its ROLLOUT_* events to its OWN regional audit sink. A us-west rollout
+        and a us-east rollout are independent events in independent sinks; one is not evidence of
+        the other.
+
+      Outage semantics: if a regional sink is down, ROLLOUT_* events for that region during the
+      outage are dropped and unrecoverable. The absence of a ROLLOUT_HEALTHY row therefore means
+      EITHER (a) no rollout happened, OR (b) a rollout happened during a sink outage and was not
+      recorded. These two cases cannot be distinguished from the audit data alone.
+  - id: pipeline-log
+    type: log
+    label: CI/CD and deploy audit stream (multiple services)
+    content: |
+      Deploy/CI audit stream. Times UTC. Multiple services appear; only ROLLOUT_HEALTHY (prod)
+      rows count as "deploys" under CF-2026-06.
+      2026-06-18 16:20:00 deploy: settlement-worker r-2201 PROD ROLLOUT HEALTHY (region us-east)
+      2026-06-19 09:10:00 vcs: ledger-service PR #2990 MERGED to main (author p.singh)
+      2026-06-19 21:30:00 deploy: ledger-service r-4410 PROD ROLLOUT HEALTHY (region us-east)
+      2026-06-19 22:40:10 vcs: billing-gateway PR #3120 MERGED to main (author k.novak)
+      2026-06-19 22:41:00 ci: billing-gateway BUILD_COMPLETED... build r-5521 STARTED
+      2026-06-19 23:05:12 ci: billing-gateway build r-5521 BUILD_COMPLETED image=sha256:9ab...c1
+      2026-06-19 23:11:30 registry: billing-gateway image r-5521 IMAGE_PUSHED
+      2026-06-19 23:14:00 approval: billing-gateway CHG-8842 APPROVAL_RECORDED (approver=t.reyes role=team-lead)
+      2026-06-19 23:20:40 deploy: billing-gateway r-5521 STAGING ROLLOUT STARTED (us-east-staging)
+      2026-06-19 23:26:15 deploy: billing-gateway r-5521 STAGING ROLLOUT HEALTHY (us-east-staging)
+      2026-06-20 00:00:00 freeze: CF-2026-06 window OPEN (us-east payments)
+      2026-06-20 01:10:00 deploy: analytics-api r-7781 PROD ROLLOUT HEALTHY (region us-east)   [not payments-tier]
+      2026-06-20 06:30:00 deploy: recommendations-api r-6602 PROD ROLLOUT HEALTHY (region us-west)
+      2026-06-20 07:15:00 vcs: billing-gateway PR #3126 MERGED to main (author k.novak)   [unrelated later PR, not r-5521]
+      2026-06-20 08:00:00 audit-sink(us-east): event delivery STOPPED (incident INF-990)
+      2026-06-20 11:40:00 deploy: settlement-worker r-2205 STAGING ROLLOUT HEALTHY (us-east-staging)
+      2026-06-20 14:12:00 deploy: search-api r-5140 PROD ROLLOUT HEALTHY (region us-west)
+      2026-06-21 03:04:00 deploy: billing-gateway r-5521 PROD ROLLOUT STARTED (region us-west)
+      2026-06-21 03:12:20 deploy: billing-gateway r-5521 PROD ROLLOUT HEALTHY (region us-west)
+      2026-06-21 07:45:00 deploy: notifications-api r-3320 STAGING ROLLOUT HEALTHY (us-east-staging)
+      2026-06-22 09:00:00 deploy: profile-api r-8890 PROD ROLLOUT HEALTHY (region us-west)
+      2026-06-22 12:00:00 audit-sink(us-east): event delivery RESTORED (INF-990 resolved)
+      2026-06-22 15:30:00 deploy: ledger-service r-4433 PROD ROLLOUT HEALTHY (region us-east)   [after sink restored; different service]
+      2026-06-23 23:59:59 freeze: CF-2026-06 window CLOSE
+      2026-06-24 08:02:00 audit query: no ROLLOUT_STARTED or ROLLOUT_HEALTHY (region us-east, env=prod) exists for billing-gateway r-5521, at any date
+      2026-06-24 08:03:00 audit query: the only billing-gateway prod ROLLOUT_HEALTHY on record is region us-west at 2026-06-21 03:12:20
+      2026-06-24 08:04:00 audit query: billing-gateway us-east running-version dashboard is derived from these events and shows no r-5521 us-east rollout record
+  - id: deploy-audit-table
+    type: table
+    label: Retained production/staging rollout records
+    content: |
+      service              region   env      event            timestamp_utc
+      settlement-worker    us-east  prod     ROLLOUT_HEALTHY  2026-06-18 16:20:00
+      ledger-service       us-east  prod     ROLLOUT_HEALTHY  2026-06-19 21:30:00
+      analytics-api        us-east  prod     ROLLOUT_HEALTHY  2026-06-20 01:10:00
+      recommendations-api  us-west  prod     ROLLOUT_HEALTHY  2026-06-20 06:30:00
+      search-api           us-west  prod     ROLLOUT_HEALTHY  2026-06-20 14:12:00
+      billing-gateway      us-east  staging  ROLLOUT_HEALTHY  2026-06-19 23:26:15
+      billing-gateway      us-west  prod     ROLLOUT_HEALTHY  2026-06-21 03:12:20
+      profile-api          us-west  prod     ROLLOUT_HEALTHY  2026-06-22 09:00:00
+      ledger-service       us-east  prod     ROLLOUT_HEALTHY  2026-06-22 15:30:00
+      (no row exists for billing-gateway / us-east / prod, for r-5521 or otherwise)
+      Reading guide: analytics-api is not payments-tier; ledger-service and settlement-worker are
+      different services; every us-west row is a non-frozen region. None of these is a us-east
+      production rollout of billing-gateway.
+  - id: monitoring-gap-note
+    type: note
+    label: Audit-sink outage window (INF-990)
+    content: |
+      monitoring-gap-note (infra incident INF-990):
+      The us-east deploy-audit sink stopped delivering events from 2026-06-20 08:00 to
+      2026-06-22 12:00 UTC. Events that occurred in that window were not persisted and are
+      unrecoverable. The us-west and staging audit sinks were on separate infrastructure and were
+      unaffected, so us-west prod rollouts and us-east staging rollouts in that window were still
+      recorded normally.
+
+      Consequence: any us-east PRODUCTION rollout that STARTED or completed inside 06-20 08:00 to
+      06-22 12:00 has no audit record. Per audit-schema, ROLLOUT_HEALTHY is the only authoritative
+      record of a production rollout and has no secondary source. Therefore, for billing-gateway
+      r-5521 specifically: whether it rolled out to us-east production at all, and if so at what
+      time, cannot be recovered from the audit system. Note the outage window falls entirely
+      inside the freeze window.
+  - id: change-ticket
+    type: note
+    label: Change ticket CHG-8842 (contains a deployment claim)
+    content: |
+      change-ticket CHG-8842 - billing-gateway r-5521
+
+      Fields as entered by requester k.novak:
+        merged:              2026-06-19 22:40
+        built:               2026-06-19 23:05
+        image_pushed:        2026-06-19 23:11
+        approved_by:         t.reyes (role: team-lead)
+        emergency_exception: (blank)
+        regions_targeted:    us-west, us-east
+      Deployment note (free text): "Deployed to production on 2026-06-19, safely before the
+      freeze window opened. No freeze impact."
+
+      Post-freeze reviewer question appended: "The 06-19 date - is that a PRODUCTION rollout, or
+      is it the merge / build / staging time? The audit stream shows a us-west prod rollout on
+      06-21 and no us-east prod record at all for r-5521. And the emergency_exception field is
+      blank, so if it did go to us-east prod during the freeze there was no exception on file."
+  - id: oncall-chat
+    type: note
+    label: On-call thread (speculation, unverified)
+    content: |
+      oncall-chat: #deploys thread, 2026-06-24
+
+      k.novak: did billing-gateway r-5521 reach us-east prod before the freeze?
+      t.reyes: the ticket says deployed 06-19, so we should be fine.
+      s.park: 06-19 is the merge and staging time though. The only prod ROLLOUT_HEALTHY I see for
+              r-5521 is us-west at 06-21 03:12. There is no us-east prod HEALTHY for r-5521 anywhere.
+      k.novak: the us-east audit sink was down 06-20 08:00 to 06-22 12:00 (INF-990), so a us-east
+               rollout in that window would not have been logged. Or it may not have gone out yet.
+      s.park: and per audit-schema there is no backup source - ROLLOUT_HEALTHY is the only record.
+      t.reyes: ledger-service shows a us-east prod rollout on 06-22 15:30 though - doesn't that count?
+      s.park: that is ledger-service, a different service. Says nothing about billing-gateway.
+      k.novak: so we cannot confirm or rule out a us-east freeze-window deploy of r-5521 from what we have.
+      t.reyes: agreed - we do not actually know when, or whether, us-east prod took r-5521.
+tags: [missing-evidence, change-freeze, deploy, audit-gap, region-scope]