chore(release): update desktop-client version to 0.1.11 and document July 12 release audit

task_plan.deploy-39.md

@@ -28,6 +28,26 @@ Complete
 - [x] Exercise health/API endpoints
 - [x] Record deployed image identifiers and rollback instructions
 
+### Phase 5: July 12 Delta Audit
+- [x] Compare current clean HEAD with the July 10 deployed source snapshot
+- [x] Identify affected images, configuration, and migrations
+- [x] Run tests/builds appropriate to the delta
+
+### Phase 6: July 12 Backup and Sync
+- [x] Build and checksum target-native release archives
+- [x] Capture a new remote rollback point
+- [x] Upload and independently verify release artifacts
+
+### Phase 7: July 12 Rollout
+- [x] Import release images; migration Job correctly skipped because no migration changed
+- [x] Confirm no configuration changes are required
+- [x] Roll affected workloads and wait for readiness
+
+### Phase 8: July 12 Verification and Cleanup
+- [x] Verify controllers, endpoints, logs, schema, and release contents
+- [x] Remove stale application ReplicaSets and unreferenced old application images
+- [x] Clear only `geo:cache:*` and preserve Redis operational state
+
 ## Decisions
 | Decision | Rationale |
 |----------|-----------|
@@ -35,6 +55,7 @@ Complete
 | Preserve remote secrets and runtime data | Source synchronization must not replace environment-specific credentials, volumes, or cluster state. |
 | Create a rollback snapshot before mutation | The source is a dirty worktree and cannot be reconstructed from a single commit. |
 | Clear old runtime state only after successful rollout | Preserves rollback and avoids taking down the healthy release before its replacement is ready. |
+| Use the July 10 remote source snapshot as the delta baseline | That release included a workspace snapshot, so commit history alone may overstate what is new. |
 
 ## Errors
 | Error | Attempt | Resolution |
@@ -54,9 +75,16 @@ Complete
 | Local kubectl still attempted API discovery for a client dry-run of the backed-up ConfigMap and could not reach its configured local cluster | 1 | No patch was produced; use Ruby's standard YAML and JSON parsers on the trusted backup, then verify the extracted prompt against the known old hash before upload. |
 | Final verification stopped after HTTP checks because one log-archive command returned nonzero under `set -e` | 1 | Deployment state remains healthy; run each selector log read independently to identify the exact failure, then make the final verifier tolerate empty/no-log sources while still scanning available logs. |
 | Two `geo:cache:*` keys were naturally repopulated by live traffic after the verified cleanup, so a later zero-cache assertion stopped final verification | 1 | Complete all remaining read checks first, then repeat the same prefix-scoped deletion as the final action and immediately verify protected Redis key classes are unchanged. |
+| July 12 source comparison used `path` as a zsh loop variable, which overwrote the shell's special PATH array and made later commands unavailable | 1 | Archive verification/extraction succeeded and no remote state changed; rerun the comparison with a neutral loop variable such as `item`. |
+| A July 12 archive diagnostic assigned to zsh's read-only special variable `status` and exited after printing the correct source commit | 1 | Image tag/platform/content and checksums had already passed; finish source/build-input verification with a neutral variable such as `rc`, without rebuilding. |
+| `gzip -dc | git get-tar-commit-id` returned 141 under `pipefail` because Git intentionally stops reading after the PAX commit header and gzip receives SIGPIPE | 2 | Do not repeat the pipeline; decompress once to a temporary tar, read the commit ID via file redirection, then remove the temporary file. |
+| The first restored pause-image upload placed the tar at incoming root while its checksum manifest referenced `images/`, so target verification failed before import | 1 | Move the already uploaded tar into `incoming/images/`, reverify SHA-256, then import it; no unverified image was imported. |
+| The original frontend rollout SSH client remained open after the remote process disappeared, despite the deployment succeeding | 1 | Confirmed the rollout and new Pod separately, then terminated only the orphaned local SSH client and will repeat the remaining checks read-only. |
+| First rollback-guide patch omitted an Add File `+` marker on one line and was rejected before writing | 1 | Reissued the same guide with a syntactically valid patch; no existing file was changed by the failed attempt. |
 
 ## Outcome
 - Release `workspace-5463319-20260710120256` is fully deployed on 39.
 - Migration `20260710183000` is clean and all three media-favorite tables exist.
 - All application and infrastructure controllers are Ready; all release Pods have zero restarts.
 - Old zero-replica ReplicaSets, unreferenced old geo-rankly images, and `geo:cache:*` were removed while protected Redis/runtime data and rollback artifacts were retained.
+- July 12 frontend-only release `workspace-e68db14-20260712150344` is deployed and verified; desktop-client publishing was explicitly left to the user.