docs: record the sealed database cutover

docs/evidence.md

@@ -117,6 +117,18 @@ a `Permanent` rejection of replayed lines older than Loki's acceptance window,
 which drops those lines rather than blocking, and leaves live traffic
 unaffected.
 
+## Sealed database cutover
+
+Verified on 2026-08-28 against the two-node Fedora cluster. PostgreSQL was
+stopped, its disposable PVC and manually managed Secret were removed, and the
+committed `nereus-db` SealedSecret created the replacement Secret. The
+controller reported `Synced=True`, the new 5 GiB PVC bound, PostgreSQL reached
+one ready replica, three restarted API pods became ready, and both load
+generators remained healthy after their rollouts.
+
+No plaintext credential was written to the repository, Terraform state, shell
+output, or evidence.
+
 ## Presentation commands
 
 ```bash

docs/roadmap.md

@@ -208,7 +208,7 @@ task. Mark a task `[x]` only after its stated verification passes.
 - [H] Create the real error-rate AnalysisTemplate. Agent-authored 2026-08-21; PromQL never evaluated against real series.
 - [H] Configure blue-green promotion and automated rollback. Agent-authored 2026-08-21; promotion and abort paths untested with the real API.
 - [H] Maintain Forgejo Actions and GitHub mirror workflows.
-- [~] Install Sealed Secrets and commit the encrypted database resource; safe cutover awaits a fresh database volume.
+- [x] Install Sealed Secrets, commit the encrypted database resource, and verify the fresh-volume cutover.
 
 ## Forgejo CI/CD