docs: add durable runtime unblock runbook

scripts/validate-runtime-boundary.mjs

@@ -189,6 +189,38 @@ function assertRuntimePolicyText(value, label) {
   assert.ok(value.includes("microservice proxy"), `${label} must name microservice proxy`);
 }
 
+function assertIncludes(value, expected, label) {
+  assert.equal(typeof value, "string", `${label} must be a string`);
+  assert.ok(value.includes(expected), `${label} must include ${JSON.stringify(expected)}`);
+}
+
+function assertDurableRuntimeRunbook(value) {
+  const label = "docs/reference/dev-runtime-boundary.md durable runtime runbook";
+  for (const expected of [
+    "DB live readiness and durable runtime readiness are separate gates",
+    "runtime_durable_adapter_query_blocked",
+    "Source migration contract",
+    "Static runtime boundary contract",
+    "Public health observation",
+    "Live DB read verification",
+    "Live migration/repair apply",
+    "Do not run `kubectl get secret`",
+    "secretValuesPrinted=false",
+    "Before any authorized live migration or repair",
+    "After an authorized migration/repair",
+    "Cleared:",
+    "Moved:",
+    "Still blocked:",
+    "No full M3, M4, or M5 acceptance is allowed while runtime durability is blocked",
+    "node scripts/dev-runtime-migration.mjs --check",
+    "node scripts/dev-runtime-migration.mjs --dry-run --write-report",
+    "node scripts/dev-runtime-migration.mjs --dry-run --allow-live-db-read --confirm-dev --write-report",
+    "node scripts/dev-runtime-migration.mjs --apply --confirm-dev --confirmed-non-production --write-report"
+  ]) {
+    assertIncludes(value, expected, label);
+  }
+}
+
 function assertGuardFixture(guard) {
   assert.equal(guard.guard, "hwlab-runtime-boundary");
   assert.equal(guard.schemaVersion, "v1");
@@ -365,6 +397,7 @@ assertProdDisabled(
   await readJSON(guard.requiredK3sSkeleton.prodKustomizationPath),
   await readJSON(guard.requiredK3sSkeleton.prodDisabledPath)
 );
+assertDurableRuntimeRunbook(await readText("docs/reference/dev-runtime-boundary.md"));
 
 console.log(
   `validated HWLAB runtime boundary guard for ${SERVICE_IDS.length} services; forbidden substitutes: ${forbiddenRuntimeSubstitutes.join(", ")}`