docs(pmoves-yt): service runbook — two deployment paths run different yt-dlp builds

pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md

@@ -2281,3 +2281,11 @@ b8cea26c8\ that added it to the top-level equired\ array). (2) PMOVES-pinokio PR
 - `2026-08-27T15:10:00Z` CLAIM `B850-CLAUDE (Knuckles)` scope: **Reconcile every yt-dlp version/currency claim in the repo against measured reality. Branch `docs/ytdlp-currency-reconcile`, off `origin/main`, in a worktree.** Trigger: #2713 `chore(pmoves-yt): bump yt-dlp to 2026.8.19` (`47c0c0d3b`) is **docs-only** — `1 file changed, 1 insertion(+)`, a single tracker line — while the code pin never moved. A `chore(...)` subject that reads as a version bump and is not one poisons every title-level audit of "are we current on yt-dlp?". **Scope is reconciliation, NOT the fork-sync**; the upgrade (upstream → fork Hardened → gitlink promotion → image rebuild) is a separate lane needing its own claim and operator go-ahead. Deliverables: (1) measured ground truth for pin / runtime / upstream with pasted evidence; (2) sweep of every yt-dlp version + currency assertion in-repo (excluding `.worktrees/`, `.claude/worktrees/`); (3) correct what is wrong, and where a doc asserts currency it cannot know, replace the number with the mechanism to check — a pinned number in prose is what produced this; (4) annotate #2713 as docs-only without rewriting history; (5) a durable statement of the gap for the fork-sync lane to plan from. **Not touching:** the submodule gitlink, any shared or tiered env file, or the PMOVES.YT submodule tree (editing it would move the gitlink). Three-body: delivery=B850-CLAUDE, control=DARKXSIDE + review bots, memory=this trail. CHIT trail **unsigned-local** (no `sign-trail` make target exists). `agent_signature: ACK::B850-CLAUDE::YTDLP-CURRENCY-RECONCILE-CLAIM::2026-08-27`.
 
 <!-- GRAPHITI_MARK: B850-CLAUDE::YTDLP-CURRENCY-RECONCILE::2026-08-27 -->
+
+- `2026-08-27T23:50:00Z` CLAIM `B850-CLAUDE (Knuckles)` scope: **PMOVES.YT Docker/service runbook — the ops doc that lane keeps needing and does not have.** Branch `docs/pmoves-yt-runbook`. New file `pmoves/docs/services/pmoves-yt/RUNBOOK.md` (joins existing `README.md` + `UPDATE_NOTES.md`; links to PR #2793's `YTDLP_CURRENCY.md` for version/currency rather than restating — #2793 verified **open, not merged** at claim time). Leads with the two-deployment-paths discriminator: `up-yt` builds `../PMOVES.YT` (fork yt-dlp) vs `up-yt-published` pinning `ghcr.io/powerfulmoves/pmoves-yt:pmoves-latest`, which `integrations-ghcr.matrix.json` builds from `pmoves/services/pmoves-yt/Dockerfile` — a **stock PyPI `yt-dlp[default]`** install, i.e. without the fork commits. Covers all six bring-up variants, health verification, the cookie chain, log locations, common failures by operator-visible symptom, and teardown. Not in scope: changing any Makefile target or compose file, yt-dlp version currency (#2793 owns it), `pmoves/docker-compose*.yml` (damage-control read-only on this node).
+
+<!-- GRAPHITI_MARK: B850-CLAUDE::PMOVES-YT-RUNBOOK::2026-08-27 -->
+
+- `2026-08-28T01:15:00Z` RELEASE `B850-CLAUDE (Knuckles)` scope: **Closes the 23:50 CLAIM — `pmoves/docs/services/pmoves-yt/RUNBOOK.md` (642 lines), plus a pointer from `README.md`.** **The two-paths fact held, and verification sharpened it in two ways that change operator guidance.** (1) **The image name is a hint, not the fact.** `docker-compose.integrations.images.yml` overrides *only* `image:` — the base service's `build: {context: ../PMOVES.YT}` **survives the merge**, confirmed by `docker compose config` on both chains. So a node with the submodule checked out can run a locally-built fork image *wearing the GHCR name*. The runbook therefore gives three commands, not one, and names `/healthz`'s `yt_dlp_version` as authoritative. (2) **`RepoDigests` does NOT discriminate build-vs-pull** — this node's locally-built `pmoves-pmoves-yt` carries `sha256:bf62dae4...`; I checked before writing it up rather than after. **This node is on the SOURCE path**: image `pmoves-pmoves-yt` (no registry prefix), `/healthz` → `2026.07.04`, matching the pin `ebd39b7f` — which `git -C PMOVES.YT branch --contains` places on the unmerged `feat/upstream-sync-2026.07`, NOT the `.gitmodules`-declared `PMOVES.AI-Edition-Hardened` (`2026.02.04`). The `--remote` downgrade hazard is real and documented with the reproduction. **Two undocumented failure modes found while verifying, both in the "healthy but lying" class.** (a) **`pmoves-yt` on this node is running cookie-less**: `YT_COOKIES` reads the base-compose *placeholder* `darkxside.youtube.cookies.txt`, that file does not exist (dir holds only `.gitignore`), and no `yt-cookies-vol` is mounted — so the `yt-cookies` overlay was never applied. Reading `YT_COOKIES` is now the documented one-command check for "is the cookie chain actually wired in". Worth stating plainly: **`up-yt-published` and `up-yt-hardened` are cookie-less as written** — both use `$(DC)` and neither passes `--profile yt-cookies`, so this is expected on those paths, not a fault. (b) **`yt-cookie-writer` reports `healthy` with a dead NATS subscription**: its healthcheck asserts only that `/tmp/healthy` exists, touched once at first subscribe and never removed — measured a DNS failure at `2026-08-27T14:10:15Z` sitting behind a marker file dated Aug 15, `FailingStreak: 0`, `RestartCount: 0`. **Commands were run, not imagined**: `yt-docs-catalog-smoke` (1751 extractors), `yt-jellyfin-smoke` (**extraction PASSed** on `dQw4w9WgXcQ` — the FAIL is the Jellyfin bridge on `:8093`, absent on this node), `POST /yt/info`, bgutil `/ping` (`1.2.2`), `make -n up-yt-amd` (2 `amd.yml` refs vs 0 for `up-yt`). One transcription error self-caught and fixed: the `RAW_COMPOSE` grep returns two lines, not one. **Gaps admitted rather than papered over** — §9 lists four: the GHCR image is unverifiable from here (`manifest inspect` → `denied`, `gh api` → `403 read:packages`), whether the writer re-subscribed, the four published/hardened targets are recipe-verified not execution-verified, and `/metrics` carries no `yt_`-prefixed series. **Also documented**: no `down-yt` Known Road exists (`grep -c` → 0), so teardown uses `docker compose ... stop`, which the enforcer permits — its regex blocks only `up|restart|down`. `yt-cookies-status` fails from the host on in-network `SUPABASE_URL` (papercut, not a pipeline fault). Deferred to #2793 rather than restated: all version-currency questions. No Makefile or compose file touched. CHIT trail **signed**, `hmac: BkvRVrRYkKYV1GD8JtqA4ZUfCxOIGcPduZe9fiITnAE=`, kid `chit-signing-v01`, card `...036`. `agent_signature: ACK::B850-CLAUDE::PMOVES-YT-RUNBOOK-RELEASE::2026-08-28`.
+
+<!-- GRAPHITI_MARK: B850-CLAUDE::PMOVES-YT-RUNBOOK-RELEASE::2026-08-28 -->

pmoves/docs/services/pmoves-yt/README.md

@@ -2,6 +2,10 @@
 
 Status: Implemented (compose)
 
+> **Operating this service?** See [`RUNBOOK.md`](./RUNBOOK.md) — bring-up, health checks,
+> the cookie chain, failure triage, teardown. Start with its §1: there are two deployment
+> paths, only one of them actually runs, and §1.1 is how you tell which you are on.
+
 Overview
 - YouTube ingest and processing; integrates with MinIO and Supabase.
 - Authoritative runtime now lives in the [PMOVES.YT submodule](C:/Users/russe/Documents/GitHub/PMOVES.AI/PMOVES.YT) under `pmoves_yt_service/`.