add Phase 2A host maintenance procedure

docs/le-app-database-migration/phase2a-host-maintenance/reboot-procedure.md

@@ -0,0 +1,65 @@
+# Separate reboot procedure
+
+This procedure begins only after successful package execution and review of its unique maintenance record. It never reboots automatically. Maintenance and validation records are atomic unique root-owned mode `0700` directories. They can contain sensitive operational metadata and must not be committed.
+
+## Pre-reboot verification
+
+Set the exact record path printed by `execute-maintenance.sh`:
+
+```bash
+record=/var/log/le-phase2a-maintenance/maintenance.YYYYMMDDTHHMMSSZ.XXXXXXXX
+test -d "$record" || { printf 'STOP: invalid record path\n' >&2; return 1; }
+```
+
+Record the running kernel and review installed kernel packages:
+
+```bash
+uname -a | tee "$record/running-kernel-immediately-before-reboot.txt"
+pacman -Q linux linux-headers linux-zen linux-zen-headers |
+  tee "$record/installed-kernels-immediately-before-reboot.txt"
+```
+
+Verify both new module trees, kernel images, and nonempty initramfs files:
+
+```bash
+find /usr/lib/modules /boot -maxdepth 2 -type f \
+  \( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \
+  -printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\n' |
+  sort | tee "$record/verified-kernel-initramfs-files.txt"
+
+find /boot -maxdepth 1 -type f \
+  \( -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' \) -size 0 -print
+```
+
+Any zero-length artifact is a hard stop. Review DKMS and package hook output:
+
+```bash
+dkms status | tee "$record/dkms-immediately-before-reboot.txt"
+systemctl --failed --no-pager | tee "$record/failed-units-immediately-before-reboot.txt"
+sed -n '1,240p' "$record/hook-restart-summary.txt"
+```
+
+Confirm bootloader state without changing it:
+
+```bash
+bootctl status 2>&1 | tee "$record/bootctl-status-before-reboot.txt"
+find /boot/loader/entries -maxdepth 1 -type f -print -exec sed -n '1,160p' {} \; 2>/dev/null |
+  tee "$record/systemd-boot-entries-before-reboot.txt"
+
+grub-install --version 2>&1 | tee "$record/grub-version-before-reboot.txt"
+test -f /boot/grub/grub.cfg &&
+  grep -E "^menuentry |^submenu |linux.*vmlinuz|initrd" /boot/grub/grub.cfg |
+  tee "$record/grub-entries-before-reboot.txt"
+```
+
+The operator must identify and record both the intended new-kernel entry and a known-good previous-kernel/fallback entry. Stop if boot entries or initramfs references are missing, DKMS failed, storage is degraded, backups are unavailable, SSH is unstable, or production is unhealthy.
+
+## Separately approved reboot command
+
+Only after explicit approval for this exact reboot:
+
+```bash
+sudo systemctl reboot
+```
+
+Do not embed this command in the maintenance script, a timer, `at`, a shell trap, or a command chain. Keep independent console access open and proceed to `post-reboot-validate.sh` after the host returns.