docs: drop stale rollback-file references now that rollback/ is removed

qbittorrent.yaml and jdownloader.yaml's own header comments still
pointed at manifests/media/rollback/*-gluetun.yaml and described the
migration as pending approval/preconditions - both are live and
validated now, and that directory is being removed (no kept on-disk
Gluetun copy). Rewrite both headers as a status note instead, pointing
rollback at git history (with the exact pre-migration commit) to match
the root README's rollback table, which gets the same exact-commit
treatment here instead of the vaguer reference from the previous
commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -251,7 +251,8 @@ piece's own README for exact commands and rollback:
 | Minisforum PIA gateway (WireGuard, policy routing, kill switch, health check) | `ansible/roles/pia-gateway/` | that role's README |
 | nik-debian VLAN 50 parent (`enp1s0.50`) | `ansible/roles/vlan50-parent/` | that role's README |
 | Multus, VLAN 50 NAD, canary | `manifests/multus/` (manual-sync Argo CD Application) | that directory's README |
-| qBittorrent / JDownloader VLAN 50 attachment | `manifests/media/qbittorrent.yaml`, `jdownloader.yaml` | no file-based copy kept — restore the pre-migration Gluetun manifest from git history (`git show <commit-before-migration>:manifests/media/qbittorrent.yaml`, likewise for jdownloader.yaml) and `kubectl apply` it; both migration commits are tagged in their own message |
+| qBittorrent VLAN 50 attachment | `manifests/media/qbittorrent.yaml` | no file-based copy kept — `git show 28d0628:manifests/media/qbittorrent.yaml \| kubectl apply -f -` restores the last pre-migration (Gluetun-based) version |
+| JDownloader VLAN 50 attachment | `manifests/media/jdownloader.yaml` | same approach — `git show 2f7ec5f:manifests/media/jdownloader.yaml \| kubectl apply -f -` |
 
 **Boot ordering** (minisforum): `pia-killswitch.service` seeds the closed
 routing/firewall state and is ordered `Before=` `wg-quick@pia-wg.service`;

manifests/media/jdownloader.yaml

@@ -2,24 +2,22 @@
 # Delete: kubectl delete -f manifests/media/jdownloader.yaml
 # Description: JDownloader deployment with Ingress at jdownloader.home.arpa.
 #
-# *** VLAN 50 MIGRATION — DO NOT PUSH TO main WITHOUT SEPARATE, EXPLICIT
+# VLAN 50 MIGRATION — live since 2026-08-24, migrated after qBittorrent
-#     APPROVAL — AND ONLY AFTER qBittorrent (manifests/media/
+# was live, validated, and soaked (plan.md's explicit ordering — the two
-#     qbittorrent.yaml) HAS BEEN LIVE, VALIDATED, AND SOAKED. plan.md is
+# were deliberately not batched). Same VLAN 50/Multus design as
-#     explicit: migrate qBittorrent first, soak, then JDownloader,
+# qbittorrent.yaml — see the root README's "VPN VLAN 50" section for the
-#     independently soaked — do not batch them. ***
+# full status/runbook. One difference: JDownloader has no
-# Same VLAN 50/Multus design as qbittorrent.yaml (see that file's header
+# reliably-persistent, file-editable interface-bind setting the way
-# for the full precondition list — pia-gateway, vlan50-parent, and
+# qBittorrent's qBittorrent.conf does (its own preferences aren't a
-# manifests/multus/ all applied and verified first). One difference:
+# simple INI this repo can safely patch), so this migration relies on the
-# JDownloader has no reliably-persistent, file-editable interface-bind
+# network-namespace egress guard alone for enforcement, exactly as
-# setting the way qBittorrent's qBittorrent.conf does (its own
+# plan.md anticipated for JDownloader specifically ("application-level
-# preferences aren't a simple INI this repo can safely patch), so this
+# interface binding may be weaker or unavailable... the namespace egress
-# migration relies on the network-namespace egress guard alone for
+# guard is mandatory") — confirmed live via this workload's own
-# enforcement, exactly as plan.md anticipates for JDownloader
+# fail-closed kill-switch test. `media` has selfHeal+automated sync — any
-# specifically ("application-level interface binding may be weaker or
+# future push to this file deploys immediately. No pre-migration Gluetun
-# unavailable... the namespace egress guard is mandatory").
+# copy is kept on disk; roll back via git history instead — see the root
-# `media` has selfHeal+automated sync already configured — pushing this
+# README's Rollback table for the exact commit.
-# file deploys it immediately. Rollback copy, not synced by any
-# Application: manifests/media/rollback/jdownloader-gluetun.yaml.
 apiVersion: apps/v1
 kind: Deployment
 metadata:

manifests/media/qbittorrent.yaml

@@ -2,35 +2,21 @@
 # Delete: kubectl delete -f manifests/media/qbittorrent.yaml
 # Description: qBittorrent deployment with Ingress at qbittorrent.home.arpa.
 #
-# *** VLAN 50 MIGRATION — DO NOT PUSH TO main WITHOUT SEPARATE, EXPLICIT
+# VLAN 50 MIGRATION — live since 2026-08-24, validated end to end
-#     APPROVAL, EVEN IF OTHER FILES IN THIS SESSION HAVE ALREADY BEEN
+# (Phase 5 canary matrix plus this workload's own fail-closed kill-switch
-#     PUSHED ***
+# test: stopping wg-quick@pia-wg on minisforum stops its egress, no
-# This Deployment now attaches VLAN 50 (net1, 10.10.50.10) via Multus
+# fallback to eth0). This Deployment attaches VLAN 50 (net1, 10.10.50.10)
-# instead of running a per-pod Gluetun/OpenVPN sidecar — PIA egress is now
+# via Multus instead of running a per-pod Gluetun/OpenVPN sidecar — PIA
-# minisforum's job (ansible/roles/pia-gateway), reached through
+# egress is minisforum's job (ansible/roles/pia-gateway), reached through
 # nik-debian's enp1s0.50 (ansible/roles/vlan50-parent) and the Multus NAD
-# (manifests/multus/10-nad-vlan50.yaml). Preconditions before this can
+# (manifests/multus/10-nad-vlan50.yaml); see the root README's "VPN VLAN
-# ever be pushed live, per plan.md's phasing:
+# 50" section for the full status/runbook. `media` (this file's
-#   1. ansible/roles/pia-gateway and ansible/roles/vlan50-parent applied
+# Application) has selfHeal+automated sync — any future push to this file
-#      and independently verified live.
+# deploys immediately, no separate "sync" gate. No pre-migration Gluetun
-#   2. manifests/multus/ synced (00 through 10) and its own health
+# copy is kept on disk; roll back via git history instead (`git show
-#      confirmed — the initContainer below depends on the
+# <commit-before-migration>:manifests/media/qbittorrent.yaml`, then
-#      vlan50-egress-guard-script ConfigMap that lives in that
+# `kubectl apply -f -`) — see the root README's Rollback table for the
-#      Application, not this one; Argo CD does not enforce that
+# exact commit.
-#      cross-Application ordering automatically.
-#   3. The Phase 5 canary (manifests/multus/20-canary.yaml) has passed
-#      the full validation/failure-test matrix in plan.md, including
-#      packet-capture proof of the kill switch and restart behavior.
-# `media` (this file's Application) has selfHeal+automated sync already
-# configured — pushing this file to main deploys it immediately, with no
-# separate "sync" gate. The previous Gluetun-based Deployment is kept,
-# unmodified, at manifests/media/rollback/qbittorrent-gluetun.yaml — that
-# subdirectory is deliberately NOT synced by this Application (media.yaml
-# has no directory.recurse: true, so it only ever looks at files directly
-# in manifests/media/, never in manifests/media/rollback/) — for fast
-# manual rollback: kubectl apply -f manifests/media/rollback/
-# qbittorrent-gluetun.yaml. See that file's own header for the full
-# rollback procedure.
 apiVersion: v1
 kind: Namespace
 metadata: