Questions for the team

Everything this review surfaced that still needs an answer. Roughly ordered by urgency. See Issue Resolved for everything that's already fixed.

Questions

1. Privacy Portal's TLS certificate expired 2026-07-29 — confirmed live, a real backend is answering requests today but gets a hard TLS error. Unrelated to the migration; can this be renewed now, independent of the cutover timeline?
2. The SNS→Slack alerting pipeline as configured can't ever deliver a message (a raw Slack webhook can't complete SNS's confirmation handshake) — who's picking AWS Chatbot or a Lambda shim, and when?
3. Was Step 0 of the runbook actually signed off before Phase 1 (the six PRs) started? /zoomverify/ is confirmed still served directly from gateway disk, unmigrated to S3+CloudFront. Backends handling CORS OPTIONS natively and /nginx_status's scraper being identified remain unconfirmed either way.
4. Was alb-apse2-stag-server meant to be the real staging target all along, with the missing piece being "connect it to the real backends" — or is migrationv2 intentionally correct just because it already has real backends attached?
5. Can arep.cc's fallback, automated.arep.co, and staging.arep.ink be pointed away from the dead, unassociated EIP they all currently resolve to? Independent of migration timing, this is a production bug today.
6. Should alb-apse2-stag-migrationv2's 3 existing target groups be brought under Terraform via terraform import (low-risk)? And separately, should we take on full ownership of the ALB and listener themselves, which would let us fix its 60s idle_timeout (nginx expects 120s) but means owning a load balancer nobody's managed as code before?
7. Since app.audiencerepublic.com is already served by Netlify, not the gateways, can gateway1/gateway2 be fully retired instead of downsized — and does that make the SPA-to-CloudFront workstream unnecessary? Needs a decision before production's decommission phase.
8. Privacy Portal is confirmed real and active — depends on gateway1 continuing to exist. If gateway1 is fully retired per the question above, how should Privacy Portal's continuity be handled so it doesn't break silently?
9. Can support.audiencerepublic.com get a real DNS record? Live nginx already redirects arep.co/support and the Zoom-integration support article there today, and it currently doesn't resolve at all — pre-existing, independent of the cutover.
10. What are the 9 running instances (deferred-collector-work-1..4, deferred-work-1..5) sitting next to the collector service, and are they still needed? Not referenced anywhere in nginx's config or any planning document.
11. Does Phase 1's timeline actually account for ACM DNS validation occasionally taking longer than the usual 15–60 minutes, per Appendix F's own caveat, or is it assumed to just work?
12. Is the google-site-verification TXT record on staging.arep.co still the one actually in use? Confirmed still present and unaffected by the migration plan, but confirming it's current needs someone with Google Search Console access.
13. Who holds the rollback command pre-staged during each cutover watch window — the same person driving the cutover, or a second set of hands?
14. Is "materially exceeds baseline" (the rollback trigger condition) defined anywhere as an actual number, or left to judgment on the day?
15. alb-apse2-stag-migrationv2's name is easy to misread — it reads like staging-account infrastructure, but it physically lives in the production account. Worth documenting more clearly so the next person doesn't hit the same confusion this took a while to untangle?