docs(release): confirm M5 coordinated train

docs/runbooks/m5-coordinated-release-train-readiness.md

@@ -1,6 +1,7 @@
 # M5 coordinated release train — deployment readiness and execution control
 
-- Status: **draft coordination control-plane**
+- Status: **Released**
+- Train confirmation: `2026-07-17 KST` — lead reconciliation of the M5 common release evidence and individual release evidence
 - Date: 2026-07-16
 - Coordinator: TREX lead
 - Scope: `trex-core` REL-011, `portfolio-hub` REL-004, `trex-web` REL-002
@@ -8,17 +9,17 @@
 
 ## 1. Decision statement
 
-The three releases have implementation and non-production verification evidence sufficient to **request** their individual release executions. They are **not yet authorized as deployed**. No operator may infer a production approval, service restart, database migration, proxy change, credential change, or live reconciliation from this readiness record.
+The M5 coordinated train is **Released**. The lead reconciled the M5 common evidence handoff with the individual, release-specific records: `trex-core REL-011` is released; `portfolio-hub REL-004` is released with a documented non-blocking test-fixture follow-up; and `trex-web REL-002` is released. The later `trex-core REL-012` is a separately released post-M5 hotfix and is not a prerequisite for this M5 decision.
 
-A release may start only when its own approval and every listed gate is satisfied. A failure in one release stops that release and blocks any dependent later release; it does not by itself authorize a rollback or change in another service.
+No release is inferred merely from source publication: this closure relies on the recorded service-specific operational evidence and decisions cited in the inventory below. Deferred follow-ups remain owned by their respective services and do not reopen the completed M5 train.
 
 ## 2. Release inventory and evidence
 
 | Order | Service / release | Pinned application source | Evidence supporting an execution request | Non-negotiable outstanding gate |
 | --- | --- | --- | --- | --- |
 | 1 | `trex-core` REL-011 / BAT-057 | `6d90f8951dbf354eb41301492d0bcaf0af24d882` (runtime PR #42 merge `94e148940adb008db0bbd215052a1e984f7c566b`) | **Released** — Justin Ko approval `32675`, rollback SHA `7845fbe`, controlled daemon restart, startup health, and read-only smoke captured in [REL-011 execution evidence](../releases/evidence/rel-011_20260717_execution-evidence.md) | No remaining core release gate; this does not authorize live sync |
-| 2 | `portfolio-hub` REL-004 / BAT-024, BAT-025 | `914b3dc6e6b9e2cbd7068fb30435c83f0581eab5` or reviewed descendant | `597 passed, 11 warnings`; isolated PostgreSQL migration `3 passed`; committed PR #21 independent QC PASS | Justin Ko release-window approval; restorable backup; DB lock/current/schema/row-count checks; migration and platform rollout evidence |
+| 2 | `portfolio-hub` REL-004 / BAT-024, BAT-025 | `914b3dc6e6b9e2cbd7068fb30435c83f0581eab5` or reviewed descendant | **Released with deferred non-blocking test-fixture follow-up** — backup PASS; migration `20260715_0028`, schema invariants, `73 → 73` row-count preservation, Supervisor restart, `/health` 200, `db_enabled: true`, owner read PASS, non-owner HTTP 403 | No train-blocking gate; `owner_user_id` fixture follow-up remains service-owned |
-| 3 | `trex-web` REL-002 / BAT-010 | `1ec2cf4345310cab0d3468e36b31e0613668b482` or approved descendant | `npm run lint`, `npm run build`, `npm test`: `283 passed, 0 failed`; independent QC PASS | resolve and record actual reverse-proxy upstream / selected port (`3000` vs historical `8004`); `/trex`-prefix and dependency-health smoke |
+| 3 | `trex-web` REL-002 / BAT-010 | `1ec2cf4345310cab0d3468e36b31e0613668b482` or approved descendant | **Released** — build/runtime install PASS; Supervisor RUNNING on `8004`; external `/trex/` and sign-in HTTP 200; authenticated portfolio UI/session checks PASS; browser-console JS errors 0 | No train-blocking gate; npm audit low/moderate notice remains service-owned |
 
 Supporting service documents:
 
@@ -66,3 +67,13 @@ Before stopping the process, reconcile the actual reverse-proxy upstream with th
 A service becomes `released` only after its own runbook evidence is complete and the lead records `confirm-release`. Do not mark the M5 train released because a source commit was pushed, a build passed, or another service succeeded.
 
 The coordinated train closes only when all intended service releases have individual evidence and decisions, or when deferred/excluded services are explicitly recorded with rationale and follow-up ownership.
+
+## 7. `confirm-release` — M5 train
+
+**Released.** The intended M5 scope is closed with recorded individual release decisions:
+
+1. `trex-core REL-011`: released; approval, pin, rollback revision, restart, and dry-run/verify evidence complete.
+2. `portfolio-hub REL-004`: released; its `owner_user_id` test-fixture item is explicitly deferred and non-blocking.
+3. `trex-web REL-002`: released; proxy port `8004`, external `/trex` route, sign-in, authenticated portfolio flow, and browser-console checks passed.
+
+`trex-core REL-012` is recorded separately as a post-M5 hotfix. It does not change M5 scope or the train’s completion decision.