# Gallery, storage-targets and placeholders release deployed, 2026-09-10

Release `20260910-102718-8c10514` was activated by the governed module after the owner ran the
launcher. Application commit `8c10514aac96674fce3f6aaea31095e2e14da914` (deployment tooling the same
commit; candidate fingerprint `58978f83…` unchanged, 237 files). It carries, after `5a52b33`: the
search placeholders on every search box (`3d9f613`), OneDrive and Google Drive as storage targets
connected by consent (`d400e65`, with migration `20260910042518_IntakeRemoteObjectId`), and the
component gallery moved into the platform shell at `/admin/components` (`8c10514`). It supersedes
the two releases staged earlier in the day that were never executed.

Preparation: `local\deploy\Prepare-Deploy.ps1`. A WhatIf at 10:29 UTC was refused by the renewal
guard ("no successful completed renewal today": inside 09:00–15:00 UTC the guard wants that day's
win-acme run, and the task had moved to the next morning); the owner ran Execute at 13:15 UTC,
inside the window, and the guard accepted it then. Execute ran from 13:15:53 to 13:17:20 UTC:
`Ok: true`, `Outcome: Executed`, nothing thrown, 12/12 checks, 30 required migrations, transaction
`ecd2ebdd-6337-4150-80ea-669b8c23fda4`, IIS backup `SibylaE2-20260910-131553`. Evidence:
`local\artifacts\gallery-release-260910\`.

Independent verification at 13:18 UTC, outside the runner:

- all three `CURRENT.txt` pointers name the release; `PREVIOUS.txt` names `20260910-022948-5a52b33`;
- the worker service is Running from the release tree, process started 13:16:55 UTC; its first
  report after restart (13:16:57) reads signed in, source `token`;
- web `/`, API `/health`, `/health/ready` and `/health/schema` (30 migrations, matching Main and
  Preview) and docs `/naming-glossary.md` answer 200; the three IIS sites and pools are Started
  on the release paths;
- `Sibyla.Web.dll`, `Sibyla.Platform.Infrastructure.dll`, `Sibyla.Worker.Documents.dll` and
  `Sibyla.Api.dll` are byte-identical to the staged publish (SHA-256); the staged manifest names
  commit `8c10514`, not dirty;
- `/argus/components?x=1` answers `301` with `Location: /admin/components?x=1`; `/admin/components`
  challenges for sign-in as every administration page does;
- the only storage connection on Main is the enabled Nextcloud one with its credential, so
  transfers continue to it; no OAuth client is configured yet, so OneDrive and Google Drive show
  "client not configured" until the owner registers them;
- no `AiCredentialAlert` audit row exists: the sweep has nothing to send and no channel.

Rollback target on every host: `20260910-022948-5a52b33`. C6 is unchanged.