Keryx hotfix, stop-rollout, and rejection (in-repo first slice)

First slice: 17 September 2026

This packet is the in-repo slice of #129 (P6-02). It does not close that issue and does not claim a live console halt or a public status page. The tabletop is OA-129-hotfix-tabletop (done 17 September 2026; NAS evidence/keryx/2026-09-17-oa-129-hotfix-tabletop.txt, 644 B).

Tabletop evidence is OA-129-hotfix-tabletop in operator-actions.md. Severity and intake: monitoring-intake.md. Version and no-downgrade: versioning.md. Signed pipeline: Publishing Keryx. Delivery limits: safety-claims.md. Cadence: test-traceability.md.

Decision

Choice	Value
Scope	Emergency only. Do not invent a monthly train here — that is #128
Severity	Reuse monitoring-intake.md Sev1–Sev3. Do not invent a second scale
Owner	Thomas Minitsios decides hotfix, Play halt, App Store phased-release pause, Czech unpublish, and resubmission (P0-05). Backup is the same person (named concentration risk)
Channel	Secret-free GitLab + existing SafeCall account path. No public status page, mailbox, or 24/7 desk
Rollback	Stores do not downgrade installed users. Recovery is halt expansion + a new higher build
Delivery	Do not invent delivery SLOs; stay on safety-claims.md

Not claimed: live Play/ASC halt, #128 cadence, #130 minimum-version, #127 launch comms. OA-129-hotfix-tabletop and OA-132-intake-drill are done (NAS evidence 17 September 2026). Do not close #129 or #132.

When to hotfix vs wait

Class	Action
Sev1	Always a hotfix path: core alert path down on a supported tier; credential leak; store stop / unpublish
Sev2	Hotfix when a supported-tier core path or the store listing is at risk. Otherwise wait for the next train (#128)
Sev3	Wait for the next train (#128)

Record the class and the decision (hotfix / halt / unpublish / wait) on the GitLab item. Secret-free only.

Branch and version

1. Cut from the last promoted keryx-v* tag, not an unrelated development branch. Do not hard-code a future tag in this packet.
2. Increment the build number. Never replace a submitted AAB/IPA.
3. Produce the candidate with bun run release:keryx on the approved signing host. Store upload stays manual.
4. Policy detail: versioning.md.

Urgency does not authorize debug signing, reused build numbers, skipped core tests, hidden policy changes, or unrecorded production credentials.

Mandatory tests (this slice)

No device soak. Do not claim #117 or #118.

cd keryx && flutter analyze && flutter test
cd server && bun test
bun test:keryx-native --android   # when a Linux JDK is present

Plus the publishing core smoke: provision, receive/display, pause/resume, reset, permission recovery. Add focused regression for the incident. Re-check privacy/forms/listing text when the fix changes data or platform declarations.

Stop rollout

Halt immediately when a core alert path fails, signing or policy evidence is wrong, sensitive data is exposed, reviewer/client credentials are compromised, or Thomas declares no-go.

Console	This slice
Google Play	Halt a staged rollout in Play Console
App Store	Pause a phased release if one is running
Honest limit	Already-installed users keep the bad build

Do not invent console URLs or hostnames in git. Do not halt or unpublish as part of this docs slice.

Temporary unavailability and server mitigation

Czech Republic is the only store country (P0-02). Temporary unavailability is a console pause / unpublish of that listing. It is not a public status page.

Server-side mitigation may revoke ntfy tokens or tighten ACL (ntfy-auth-and-play-internal.md). It must not silently disable a safety workflow without SafeCall-path notice.

Users on the bad version

• Tell affected administrators to update or reinstall when the superseding build is live.
• Older patches stay best-effort per the current versioning.md support window.
• Forced minimum-version and store removal stay #130.

Credentials

Rotate or revoke using secret-store.md, Apple Passwords, and ntfy-auth-and-play-internal.md. When compromise requires it, rotate before code work.

Record only “rotated” on NAS evidence/keryx/. Never paste tk_…, .p8, .p12, or QR photographs into GitLab or chat.

Disclosure

Sev1 credential leak or store stop: secret-free GitLab note plus SafeCall account owners on the existing account path. No CVE process, public advisory URL, or status page is invented here. Launch / phased-rollout client communications remain #127.

Postmortem after Sev1/Sev2 follows monitoring-intake.md.

Store rejection

1. Archive the exact rejection text and the affected guideline (NAS evidence/keryx/; no secrets).
2. Keep the submitted artifact immutable.
3. Triage: clarification / extra evidence, metadata-only correction, or a new binary.
4. New build number if the binary changes. Re-run the mandatory tests and the affected go/no-go gates before resubmission.
5. Update the GitLab item, forms, and tests when the rejection shows a systemic gap.

Expedited review

Use Apple/Google expedited-review channels only when the store program allows it. The note is a concise factual impact statement plus reviewer access (the #123 environment when live). No secrets, no tk_…, no QR photos.

What this slice proves

• Hotfix authority, Sev1–Sev3 routing, and no-downgrade recovery are written without a second severity scale.
• Play halt / App Store phased pause / Czech unpublish are named; already- installed users keep the bad build.
• Credential rotation and rejection triage stay secret-free.

What this slice does not do

• Close #129.
• Halt, unpublish, or file expedited review in a live console.
• Write the #128 train or the #130 EOL matrix.
• Add a status page, mailbox, SDK, or hostname.

Operator enable

OA-129-hotfix-tabletop is done (17 September 2026). NAS evidence/keryx/2026-09-17-oa-129-hotfix-tabletop.txt (644 B). Do not close #129. Do not start #128. Do not unpublish the real listing.

Handoff

Remaining work	Owner
Remaining #129 ACs beyond the tabletop	#129
Normal release train	#128
Minimum-version / EOL	#130
Phased rollout client communications	#127
Remaining #132 ACs beyond the intake drill	#132