hermes: relocate Switchyard state from wedged node

services/hermes/switchyard-deployment.yaml

@@ -19,7 +19,7 @@ spec:
       labels:
         app: hermes-switchyard
       annotations:
-        ai.bstein.dev/config-rev: "20260811-switchyard-authority-v3"
+        ai.bstein.dev/config-rev: "20260811-switchyard-authority-v4"
         prometheus.io/scrape: "true"
         prometheus.io/port: "9005"
         prometheus.io/path: /metrics
@@ -63,7 +63,7 @@ spec:
                     values: ["true"]
                   - key: kubernetes.io/hostname
                     operator: NotIn
-                    values: [titan-18, titan-22, titan-24]
+                    values: [titan-14, titan-18, titan-22, titan-24]
       containers:
         - name: switchyard
           image: registry.bstein.dev/bstein/hermes-switchyard@sha256:3d952d528a4e4cb8afdf84f8995272f5d6107dc127b68cc20234b1da4aff43eb
@@ -241,7 +241,7 @@ spec:
             defaultMode: 0555
         - name: state
           persistentVolumeClaim:
-            claimName: hermes-switchyard-state
+            claimName: hermes-switchyard-state-rwx
         - name: routing-catalog
           persistentVolumeClaim:
             claimName: hermes-routing-catalog

services/hermes/switchyard-pvc.yaml

@@ -13,3 +13,18 @@ spec:
   resources:
     requests:
       storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hermes-switchyard-state-rwx
+  namespace: hermes
+  labels:
+    app: hermes-switchyard
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: astreae
+  resources:
+    requests:
+      storage: 2Gi

testing/tests/test_hermes_cli_lanes.py

@@ -872,6 +872,28 @@ def test_switchyard_has_a_dedicated_non_owner_identity_and_read_only_catalog():
     ]
 
 
+def test_switchyard_active_state_uses_a_relocatable_rwx_claim():
+    """A stale node attachment must not strand the routing authority."""
+    claims = [
+        item
+        for item in yaml.safe_load_all((HERMES / "switchyard-pvc.yaml").read_text())
+        if item
+    ]
+    active_claim = next(
+        item
+        for item in claims
+        if item["metadata"]["name"] == "hermes-switchyard-state-rwx"
+    )
+    assert active_claim["spec"]["accessModes"] == ["ReadWriteMany"]
+
+    deployment = yaml.safe_load((HERMES / "switchyard-deployment.yaml").read_text())
+    pod = deployment["spec"]["template"]["spec"]
+    state = next(item for item in pod["volumes"] if item["name"] == "state")
+    assert state["persistentVolumeClaim"]["claimName"] == active_claim["metadata"][
+        "name"
+    ]
+
+
 def test_switchyard_network_boundary_allows_vault_bootstrap():
     """The pre-populate init container must reach Vault before routing starts."""
     documents = [