Execution: document running-pod convergence window + break-glass drain (layer 2)

[Kenny-Heitritter]

Parent

Map #16 · implements the layer-2 decision locked in #21 (running-pod refresh policy). Doc-only.

What to build

Capture the layer-2 policy in CODEQ_DEPLOYMENT.md so operators know what to expect and what levers exist. Layer 2 = passive convergence for routine updates; documented manual break-glass for security-critical; no in-Lab banner, no automated drain.

Document:

1. The expected convergence window for routine updates — approximately the idle-cull timeout, plus the absolute max-server-lifetime cap if one is configured — as the convergence SLA.
2. The security-critical break-glass drain runbook: who pulls the lever and the one-line step (force-stop stale singleuser pods via JupyterHub admin "stop server" or kubectl delete pod → each user re-logs into a fresh pod on the patched image).

Full spec: #21.

Acceptance criteria

• CODEQ_DEPLOYMENT.md states the routine-update convergence window (idle-cull timeout + max-server-lifetime cap) as the convergence SLA.
• It documents the security-critical break-glass drain: who runs it and the one-line runbook step.
• It records that there is deliberately no in-Lab banner and no automated drain.

Blocked by

• Execution: publish the CODEQ_DEPLOYMENT.md anchor doc to dev #23 — publish the anchor doc.

[Kenny-Heitritter]

Implemented — PR open for review (not merged). Doc-only.

#42 (commit 5dc30c9) — convergence SLA uses the real helm values (staging idle-cull 30 min, prod 45 min, 5-min checks; no max-server-lifetime cap configured — confirmed absent in both values files), plus the security break-glass drain runbook and the deliberate no-banner / no-auto-drain record. That PR carries Closes #27 (fires on merge to dev).