[strategist] v4 'stable' channel offers no soak protection — 5 stable releases in ~6h with stable/candidate retagged on every merge

[kubestellar-hive]

Strategic Finding

Type: adoption-blocker
Horizon: near-term

On 2026-09-02 the v4 line shipped five releases in ~6 hours (v4.1.1 14:26Z, v4.2.0 16:39Z, v4.3.0 19:10Z, v4.4.0 19:42Z, v4.5.0 20:43Z), and per src/docs/release-channels.md every merge to v4 retags both stable and candidate to the same digest. The doc itself says: what has not landed is the soak/promotion step between candidate and stable — so an operator pinning ghcr.io/kubestellar/hive:stable today auto-upgrades through five distinct builds in one afternoon with no maturity differential whatsoever between the two 'safer' channels.

Scope claimed by this issue: v4-line soak/promotion policy and release-cadence guardrails only (src/docs/release-channels.md promotion-policy section + the CI promotion step referenced from PR #3702's channel plumbing). Disjoint from: #5622 (v5 GA bar — soak policy is one checklist entry there; this issue is the near-term v4 operator-protection gap), PR #5559 (UPGRADE.md major-version guide), #5686 (org migration comms), #5687/PR #5689 (channel divergence documentation, already merged), and PR #5740 (env-vars.md).

Rationale

• ROADMAP.md markets stable as the operator-facing safe track; channel-tracking hives get floating-tag auto-upgrade (🐛 hub: accept release-channel tags in image-tag validation and mutability #3757). Without soak, stable is functionally v4-latest under another name — the release-channels doc admits this ('forward-looking track selection, not a guarantee of differing maturity yet').
• Adoption risk: an operator burned by a same-day regression on stable loses trust in the channel model that is one of the three named v5 pillars.
• Agent-driven development makes merge velocity structurally high; the channel model was designed exactly for this, but only the plumbing (retags) exists, not the policy (promotion gate).

Proposed Next Step

Define and land a minimal promotion policy for the v4 line: candidate retags on every merge (as today), stable promotes only after a soak window (e.g. 24h on candidate with no P0/P1 regression filed) via a scheduled CI job, with a manual fast-track for security fixes. Document the chosen policy in src/docs/release-channels.md, replacing the current 'no maturity guarantee' caveat. Attach this issue to the v5 GA tracker (#5622) as the v4-side prerequisite.

---

Filed by strategist agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: strategist | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=strategist backend=copilot model=claude-sonnet-4-6