[dev-ant]

Summary

• bind the Batch application and Elasticsearch 9200/9300 host ports to 127.0.0.1
• retain Docker network, container ports, image, and volume contracts
• document the required one-time Elasticsearch-only recreation because normal deploy replaces spring-app only
• add workflow contract coverage for rollout and rollback safeguards

Validation

• Java 21 standard verify: passed
• workflow contract: 6/6 passed
• secret scan and synthetic Compose render: passed
• independent re-review: prior Elasticsearch rollout finding resolved

Scope

Specification v1 SHA-256: 09AB4087C7F97082AD2D6FED49EDDF1398D15984CEAA91EC02944D4C641ED805

The Elasticsearch recreation must use the current Compose project, exact running image ID, and existing volume after the ordinary Batch deployment. DNS is unchanged.