@@ -21,7 +21,7 @@ the same origin it was served from. PocketBase serves `pb_public/`, applies
 
 ## 2. Data model
 
-Twenty-four committed application collections. Relations are drawn
+Thirty-one committed application collections. Relations are drawn
 `child → parent`; PocketBase system/auth collections are not counted.
 
 ```
@@ -58,6 +58,15 @@ loto_events              (project, tag; applies_to → loto_events)   APPEND-ONL
 
 turnover_packages        (project, system?; supersedes → turnover_packages)   APPEND-ONLY frozen snapshot
 signatures               (subject_collection, subject_id → package XOR check)  APPEND-ONLY attestation
+
+shutdown_templates       (library header)                 the runbook, project-agnostic
+  ├── shutdown_template_steps (template)                  ordered steps, role/tag as TEXT
+  └── shutdown_contingencies  (template)                  trigger/action pairs, not steps
+shutdown_roles           (project)                        per-project role + contact registry
+
+shutdowns                (project, system?, template?)    one planned outage; editable plan
+  └── shutdown_steps     (shutdown, responsible_role?, tag?)  instantiated list; editable
+        └── shutdown_step_events (shutdown, step?, contingency?)  APPEND-ONLY execution ledger
 ```
 
 ### Collections
@@ -88,6 +97,13 @@ signatures               (subject_collection, subject_id → package XOR check)
 | `service_visits`      | Manufacturer-representative visits against a tag XOR system, with report evidence. | **append-only** |
 | `turnover_packages`   | A frozen, sealed snapshot of a scope's checkout — the signed turnover deliverable (built server-side). | **append-only** |
 | `signatures`          | A recorded attestation (name/role/statement) bound to a package or check by content hash. | **append-only** |
+| `shutdown_templates`  | A named shutdown runbook in the library (seeded from `seed/`).  | editable   |
+| `shutdown_template_steps` | Ordered library steps: group, offsets, hold point, role/tag as project-agnostic **text**. | editable |
+| `shutdown_contingencies` | Library trigger/action pairs. Not steps — no seq position, offset, or hold point. | editable |
+| `shutdown_roles`      | Per-project role registry: `role_key`, title, contact, `notify_on` (**stored, never acted on**). | editable |
+| `shutdowns`           | One planned outage. `planned_window_start` is T-0. A planning record, deliberately **not** append-only. | editable |
+| `shutdown_steps`      | The instantiated step list; role and tag are real **relations** here. Editable while planning. | editable |
+| `shutdown_step_events` | What actually happened: started/completed/held/released/aborted/resumed/not_performed/contingency_invoked, with frozen step text. | **append-only** |
 
 ### Field notes worth knowing
 
@@ -544,9 +560,24 @@ re-imports are safe.
   hook serves the file in place instead.
 - **Global tag-number uniqueness.** Rejected — real programs run multiple plants
   that reuse tag numbers. Uniqueness is per project.
-- **Building shutdown/compliance collections now.** Rejected as building ahead.
-  The domain content lives in `seed/` so it is not lost; the collections and
-  UIs come in Phases 4–5.
+- **Building shutdown/compliance collections now.** Rejected as building ahead
+  *while Phases 1–3 were the work*. The domain content lived in `seed/` so it
+  was not lost. **Superseded for the shutdown half on 2026-09-07**: Phase 4 / M2
+  arrived, ADR 0019 was accepted, and migration S created the seven shutdown
+  collections (task `100`). The compliance half still stands — the Phase 5
+  templates remain data with no execution UI.
+- **Anything that makes the shutdown module part of the go/no-go decision.**
+  Rejected permanently (ADR 0019, the LOTO doctrine of ADR 0007 applied to the
+  second module that could plausibly claim authority): no interlocks, no
+  permission-to-proceed, no "safe to cut" indicator, no green all-clear, and no
+  rule that blocks logging past an unsatisfied hold point. A hold point warns
+  and enters the derived standing; it never stands in the doorway at 2 AM when
+  the authorizer is unreachable. The app records; the written energy-control
+  procedure and the people on site authorize. The app must never be usable as
+  evidence that it is safe to cut a live main.
+- **A `status` or `current_step` column on `shutdowns`.** Rejected — hard
+  constraint #4. A step's state is its latest event, a shutdown's standing is a
+  fold over its events, and schedule variance is computed at render.
 - **Seeding the shutdown runbook as flat checklist templates.** Rejected — a
   flattened copy loses the offsets, hold points, and roles, and would diverge
   from the real runbook in `seed/`. One representation, loaded when Phase 4
@@ -742,11 +773,14 @@ Mechanics worth knowing:
   `subject_kind='service'` templates (ADR 0006).
 - `recurrence` blank = a one-time checkout checklist; `daily` / `per_shift` /
   `per_event` are the compliance cadences (Phase 5).
-- **Not loaded:** `seed/shutdown_runbook_tie_in.json`. The runbook's structure
-  (time offsets, hold points, roles with notification triggers) cannot be
-  represented as a flat checklist without losing what makes it a runbook. It
-  stays as captured domain knowledge until Phase 4 builds real shutdown
-  collections.
+- **Not loaded (yet):** `seed/shutdown_runbook_tie_in.json`. The runbook's
+  structure (time offsets, hold points, roles with notification triggers) cannot
+  be represented as a flat checklist without losing what makes it a runbook —
+  which is why it was never flattened into `checklist_templates`. The
+  collections that *can* hold it now exist (migration S, ADR 0019), so the
+  condition this note set has been met; the loader that reads the JSON into
+  them is task `110` and has not landed. Until it does, the file remains
+  captured domain knowledge and the shutdown collections are empty.
 
 *(Resolved 2026-07-09 — this section previously documented a schema divergence
 between the migration seed and `seed/`; the migrations were reconciled to the
 
@@ -266,8 +266,8 @@ block (grey).
 - Design tokens in `app.css`: one action accent (safety orange), system fonts
   for zero webfont bytes, monospace for tag numbers, severity color language.
 - **The collections are a published API contract** (`docs/API.md`, ADR 0003).
-  Sixteen are published as **v1**; the committed schema now has **24**, the
-  extra eight marked *delta* pending a contract version bump (an M3 decision).
+  Sixteen are published as **v1**; the committed schema now has **31**, the
+  extra fifteen marked *delta* pending a contract version bump (an M3 decision).
   Breaking changes to any of their shapes, semantics, or rules need an ADR and a
   contract version bump — not just a migration. Premium is a sidecar on that
   contract; capabilities it needs land in core first.
 
@@ -47,7 +47,7 @@ first ([ADR 0003](adr/0003-core-premium-sidecar-boundary.md)).
 ## Shipped (the product today)
 
 Feature-broad and working; never yet tagged, hardened, or validated. A fresh
-database from committed migrations has **24 application collections** plus
+database from committed migrations has **31 application collections** plus
 PocketBase's `users`. Authoritative descriptions live in `ARCHITECTURE.md`;
 this is the index.
 
@@ -131,8 +131,10 @@ validated — all gated by CI. No new features
 - [x] `grep -ri "linecheck" docs/ *.md` returns only historical/superseded
       references explicitly labeled as such (ADR 0014's own record); no doc names
       LineCheck as the *current or future owner* of any scope.
-- [x] Every doc that states a collection count states **24** (application
-      collections); none says 16 or 18 as the current total.
+- [x] Every doc that states a collection count states the same current total
+      (application collections); none says 16 or 18. That total was **24** when
+      M1 closed and is **31** since migration S added the seven shutdown
+      collections (ADR 0019, task 100).
 - [x] `scripts/smoke_test.sh` passes with new assertions for: `segments` in the
       existence loop, a tank leak-test seed/workflow assertion, and an
       open→resolve behavior assertion; run count is documented in the script
@@ -194,7 +196,7 @@ shutdown runbook execution UI — plus the on-mission Punch List report.
       execution model **before** the migration (the design task's output).
       *([ADR 0019](adr/0019-shutdown-runbook-execution.md), accepted
       2026-08-04.)*
-- [ ] Migrations create the shutdown collections; a fresh DB + smoke test pass.
+- [x] Migrations create the shutdown collections; a fresh DB + smoke test pass.
 - [ ] An operator can execute the seeded tie-in runbook end to end from the UI,
       producing append-only step records; executed steps are never edited.
 - [x] The Punch List report renders print-friendly and exports CSV for a system
 
@@ -18,7 +18,7 @@ implementation and decision state differ.
 | Record locking/supersession | `CURRENT` for immutable checks; `PROPOSED` for packages | Check records are born immutable; warranty claims freeze on close. | Frozen packages supersede rather than update; signatures do not carry forward. | Historical signoff can be misread as current. | Define current-package derivation, voids, and supersession UX. |
 | Evidence hashing | `PROPOSED`, `UNKNOWN` active work | No committed hash contract; staged canonicalization/hook files exist. | Versioned canonical bytes, file inclusion policy, SHA-256 identifier, golden vectors. | A non-reproducible hash creates misleading assurance. | Review allowlists, Unicode/time/number rules, file hashing, and test vectors. |
 | PDF generation | `CURRENT` browser print; `DECIDED` paid boundary | Free print-friendly HTML; no committed PDF renderer. | Basic record/index remains free; advanced compiled binder may run in paid sidecar. | Paywalling evidence would violate constraints; server PDF may burden Pi. | Define minimum free turnover artifact and whether deterministic core PDF is required. |
-| API versioning | `DECIDED`, `CURRENT` drift | `docs/API.md` calls 16 collections v1; committed schema has **24** (16 v1 + 8 delta) and selective auth. Auth/PII semantics are settled (ADR 0011); the collection-set version bump is not. | Reconcile contract, define additive vs breaking policy, publish compatibility fixtures. | Existing clients/sidecar may silently mis-handle rules or fields. | Decide the version bump for the 8 delta collections — sequenced to M3 (D12). |
+| API versioning | `DECIDED`, `CURRENT` drift | `docs/API.md` calls 16 collections v1; committed schema has **31** (16 v1 + 15 delta) and selective auth. Auth/PII semantics are settled (ADR 0011); the collection-set version bump is not. | Reconcile contract, define additive vs breaking policy, publish compatibility fixtures. | Existing clients/sidecar may silently mis-handle rules or fields. | Decide the version bump for the 8 delta collections — sequenced to M3 (D12). |
 | Cross-product handoffs | `PROPOSED` | No implemented manifest/event exchange found. | Versioned exports/events with provenance; no direct DB coupling. | Premature shapes create permanent identifiers and duplicate masters. | Approve bounded contexts, stable ids, first concrete handoff, and ownership. |
 | Paid/core boundary | `DECIDED`, `CURRENT` sidecar | ADR 0003; LoopCheck-Lookahead has separate DB and read-only HTTP consumption. | Core owns field facts/basic export; paid owns optional aggregation and compilation. | High legal/product risk if premium gains private access or required field features. | Clarify whether sidecar service-account role needs mechanical read-only enforcement. |
 | Service-cutover ownership | `RESOLVED` — stays in LoopCheck (2026-07-18) | Complete LoopCheck workflow from notice through restoration. | **Settled:** service cutover is LoopCheck's permanently; it does not move to a sibling. | — | **Resolved** — [DECISIONS.md D9](DECISIONS.md#d9--service-cutover-stays-in-loopcheck-semantics-frozen); no migration planned. |
 
@@ -63,8 +63,8 @@ workflow**. See migrations `1789000023`, `1789000024`, `1789000025`,
 
 ## Current collections
 
-**CURRENT (revised 2026-07-28).** A fresh database from committed migrations
-contains **24 application collections**, excluding PocketBase system/auth
+**CURRENT (revised 2026-09-07).** A fresh database from committed migrations
+contains **31 application collections**, excluding PocketBase system/auth
 collections (`users` is the auth collection and is additional):
 
 - Project/equipment: `projects`, `systems`, `tags`, `segments`
@@ -78,10 +78,13 @@ collections (`users` is the auth collection and is additional):
   `calibration_points`
 - Vendor service visits: `service_visits`
 - Signatures and turnover: `turnover_packages`, `signatures`
+- Shutdown runbooks (ADR 0019, schema only — no UI yet): `shutdown_templates`,
+  `shutdown_template_steps`, `shutdown_contingencies`, `shutdown_roles`,
+  `shutdowns`, `shutdown_steps`, `shutdown_step_events`
 
 The authoritative schema is the ordered migration set in `pb_migrations/`; the
 count above is verifiable with `grep -c "new Collection(" pb_migrations/*.js`.
-Of these, **16 are published as API contract v1 and 8 are marked delta**
+Of these, **16 are published as API contract v1 and 15 are marked delta**
 pending a version bump — that bump is a deliberate M3 decision, not an
 oversight. See [`API.md`](API.md).
 
@@ -173,8 +176,9 @@ PII/auth boundaries, and checks the `/t/` and `/s/` routes. It asserts the
 ADR 0011 access matrix across all three tiers — guest denial,
 authenticated-user reads/writes, the user-vs-superuser delete boundary,
 segment-create in both directions, and the field-level PII back-relation
-expand. As of the 2026-07-28 revision it also covers all 24 collections in the
-existence loop, the tank leak-test seed, the ADR 0012 open→resolve pair
+expand. As of the 2026-09-07 revision it also covers all 31 collections in the
+existence loop, the shutdown planning/execution auth asymmetry and its
+append-only event shape rules (ADR 0019), the tank leak-test seed, the ADR 0012 open→resolve pair
 (asserting the open record is **not** mutated by its resolution), and the
 newer collections' contract rules — capture-route-only creates for
 `calibrations`/`calibration_points`, the auth boundary on `test_standards`, and
 
@@ -116,7 +116,7 @@ safe.
 ## 7. How should API v1 be reconciled?
 
 - **Why it matters:** published contract v1 originally covered sixteen broadly
-  permissive collections; committed code has **24** (16 v1 + 8 delta) and
+  permissive collections; committed code has **31** (16 v1 + 15 delta) and
   selective auth. The API document now exposes that delta but cannot approve its
   own version. The auth/PII half is settled (ADR 0011, Accepted); what remains
   open is the **collection-set** version bump, sequenced to M3 (D12).
 
@@ -1,6 +1,6 @@
 # 100 — Shutdown collections migration (schema only, no UI)
 
-Status: TODO
+Status: DONE (2026-09-07 — migration `1789000034_migration_s_shutdowns.js`; open question 1 settled as the ADR recommended, contingencies stay a separate collection; smoke test 94 → 112 assertions, green)
 Milestone: M2 Shutdown Runbooks + Punch List (v0.10.0)
 Depends on: 080 (ADR 0019, accepted 2026-08-04)
 
@@ -103,17 +103,17 @@ variant**): `conditions_unavailable` · `access_blocked` ·
 
 ## Acceptance criteria
 
-- [ ] Open question 1 settled and the choice stated in the commit message.
-- [ ] The migration applies to a **fresh** database (delete `pb_data/`, run
+- [x] Open question 1 settled and the choice stated in the commit message.
+- [x] The migration applies to a **fresh** database (delete `pb_data/`, run
       `./pocketbase serve`) and `migrate down` rolls it back cleanly.
-- [ ] `scripts/smoke_test.sh` gains assertions, and its header assertion count
+- [x] `scripts/smoke_test.sh` gains assertions, and its header assertion count
       is updated: all seven collections exist; a `shutdown_step_events` create
       succeeds **without a token**; a PATCH and a DELETE of one are refused; a
       `contingency_invoked` event with no `contingency` is refused; a
       `not_performed` event with no reason is refused; an unauthenticated
       `shutdowns` create is refused and an authenticated one succeeds.
-- [ ] `scripts/smoke_test.sh` passes end to end; the browser test still passes.
-- [ ] No `pb_public/` file and no `seed/` file changed.
+- [x] `scripts/smoke_test.sh` passes end to end; the browser test still passes.
+- [x] No `pb_public/` file and no `seed/` file changed.
 
 ## Guardrails