Clean redeployment r10 — package audit and recovery implementation

Incident basis

The user reports contamination and failure of the supplied feature ZIP during complete redeployment. No new host-side diagnostic identifies the contamination's exact contents or cause. Historical r7/r8/r9 diagnostic and acceptance reports are not evidence of the current host state. This release addresses the package's recovery contract; it is not a forensic clearance of the hosting account.

Reproduced package gaps

The exact Site Improvements 3 FULL-ROOT archive has 3,048 members and no root `.htaccess`. Its root DEPLOY-ROOT instructions explicitly require overlaying an existing tree and preserving `.htaccess`, runtime state and the Python environment. Those instructions are valid only for the narrow feature update they describe, not for replacing a contaminated deployment.

The prior release verifier checked all listed bytes but searched for extra files in only `concresca_runtime` and `database/migrations`; it expressly ignored bytecode caches. Extra PHP/asset/dependency files elsewhere could survive a ZIP overwrite. This is reproduced locally, without claiming the same files existed on the user's server.

The root requirements did not declare the driver, but the archive DID include a PyMySQL wheel. The actual runtime fallback successfully imports it without installed PyMySQL. Driver absence is therefore NOT established as the cause of the failed deployment. The r10 requirements declare the existing hash-locked wheel for an explicit offline environment rebuild.

Implemented

1. Complete flat-root release containing a path-independent initial `.htaccess`. Source, installer, dependencies, private directories and caches are denied before the Python handler exists. Actual application/interpreter/private-environment paths are generated by authenticated host activation, never guessed in the ZIP.
2. Strict source inventory across the complete distributed tree. Unknown files/directories, symlinks, special files and bytecode are refused. Post-install mutable exceptions are explicit and are not misrepresented as source-validated custody.
3. Read-only `--fresh-check`, requiring the bootstrap bytes and no mutable state, old receipts, duplicate public tree, loose files or caches.
4. Standalone checksum-verified extractor that refuses every existing destination. It validates safe ZIP paths, duplicates/case aliases, types, sizes, complete manifest coverage and every file digest, then stages privately and uses Linux no-replace rename. It does not import or erase the suspect deployment and does not run any payload during extraction.
5. Distinct r10 activation/release identity and regenerated PHP backend pins. The clickable two-step activation interaction remains. Stale jobs keep their recorded release identity; there is no silent relabeling as a new success.
6. Current root deployment instructions replace the overlay workflow. Historical feature notes are visibly superseded for recovery. The guide separates code replacement, private data restoration, interpreter trust, host activation and live verification.

Preservation and custody

All three feature improvements and the original report library remain included. Existing report originals are not changed. The private package preserves prior evidence and `.uai` history, and records the new incident override in typed owners with links to this report.

Service source under `concresca_runtime`, migrations, the WSGI entry point, and feature assets are retained byte-for-byte. The root requirements change, so the runtime fingerprint changes and a fresh activation/restart/acceptance cycle is necessary. No previous receipt is made current. Database/credential recovery is not replaced by a public source archive.

The previous worker journal is quarantined, not silently imported or destroyed. Any test resources whose credentials exist only in that old journal require reviewed reconciliation; a fresh verifier does not prove they were cleaned. No unrelated schedules or database rows are deleted by the extractor.

Validation

Machine-readable validation and transcripts accompany this report. They distinguish filesystem/archive tests, real loopback Apache/PHP checks, simulated installer transactions and application tests. Local tests do not establish production LiteSpeed, MySQL, DNS, TLS, account integrity or autonomous renewal.

Remaining boundaries

Stop the existing app/worker/installer before cutover; the extractor's acknowledgement is not an independent process-state check. Keep the quarantine outside all served roots. Use reviewed external database/private-environment custody and a trusted interpreter. Suspected credential/account compromise needs separate review and rotation.

The ZIP is a complete application/site recovery payload, not a complete hosting-account image. Its SHA-256 verifies the supplied bytes, not an independent source-signing identity. Initial bootstrap `.htaccess` and later host-generated configuration are separate states. The release verifier does not audit the contents of mutable runtime custody after activation.

The current wider sixteen-source implementation backlog remains open. This deployment repair is not a closure of those source goals or a claim of independently operated useful-work acceptance.

Sources

Supplied primary package: Concresca.com-r9-SITE-IMPROVEMENTS-3-FULL-ROOT-wip.zip; corresponding private-source package; packaged activate.py, install.py, root-htaccess.template, requirements and wheel lock. User's contamination report selects the clean-replacement procedure; historical diagnostics are not substituted for fresh incident evidence.

Hosting boundaries checked against official documentation: https://docs.litespeedtech.com/lsws/cp/cpanel/cloudlinux/ and https://docs.cpanel.net/knowledge-base/web-services/how-to-install-a-python-wsgi-application/. Optional MySQL authentication dependencies: https://pymysql.readthedocs.io/en/latest/user/installation.html. These sources describe host requirements, not the user's current configuration.