ADR-004: back out of on-stack RAP; retarget to starter customizing tenant

Both tenants belong to the same starter system: my429480 is its
customizing tenant (client 100, key-user extensibility only, no ABAP)
and my431353 is its development tenant (client 080). This package had
recorded my429480 as "productive" and ADR-002 had assumed it offered
developer extensibility; both were wrong.

- ADR-004 withdraws the on-stack RAP route and moves the application to
  a side-by-side runtime against released OData APIs. ADR-002 marked
  superseded.
- Development tenant my431353 parked: all 19 ZARENA_PLM objects left
  active, sources kept in docs/handover/rap/ as reference, so the route
  stays reversible.
- Replacement host left open as OQ-11 (key-user extensibility vs CAP
  side-by-side); recommendation recorded as CAP. No build starts until
  OQ-11 is closed.
- RAP-dependent items V-2, V-3, OQ-5, OQ-8, OQ-9, OQ-10 parked rather
  than closed.
- Tenant references corrected across CLAUDE.md, KNOWLEDGE.md,
  app/README.md, the RAP handover README, the rap-developer agent and
  the reentrance-login helper README.

No SAP tenant was modified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,95 @@
 
 Append-only decision log for this package.
 
+## 2026-09-29 — Tooling retargeted to the starter customizing tenant; its credential is rejected
+
+- What changed:
+  - I pointed the shared CLI at the starter system's customizing tenant. Both
+    `_shared/.env` and the root `.env` now carry `SAP_API_URL`,
+    `SAP_API_USER` and `SAP_API_PASSWORD` for
+    `https://my429480-api.s4hana.cloud.sap`; the eight `CPI_*` and `ARENA_*`
+    variables are untouched.
+  - I renamed both parked credential files so neither name asserts something
+    false: the client-080 credential is now
+    `_shared/.env.starter-dev-my431353.bak`, and the client-100 credential is
+    `_shared/.env.starter-cust-my429480.bak` (formerly `.env.prod-my429480.bak`,
+    a name that wrongly called it productive).
+  - I corrected the tenant references in `CLAUDE.md`, `KNOWLEDGE.md`,
+    `app/README.md`, `docs/handover/rap/README.md` and
+    `.claude/agents/rap-developer.md`: the customizing tenant is the working
+    target, the development tenant is parked as of 2026-09-29 with its objects
+    in place. No historical build record was deleted.
+  - I wrote `docs/adr/ADR-004-back-out-of-on-stack-rap.md` and marked ADR-002
+    superseded in its own file, including the note that its gate "confirm
+    developer-extensibility access on my429480" was unanswerable as written.
+- Verification: **the customizing-tenant credential is rejected.** Read-only
+  GETs return HTTP 401 with SAP's logon-failed page (`Anmeldung
+  fehlgeschlagen`); the host resolves and answers, so this is the credential,
+  not reachability. I then checked every other way in and found none: the
+  rejected password is the only copy of that credential anywhere in my estate;
+  the Cloud Foundry token is expired, so the `mc-s4hana` destination is out of
+  reach; and the client-certificate path in the shared client looks for
+  `_shared/certs/az-api-user.crt` and `.key`, which do not exist. No writes of
+  any kind were issued to any tenant.
+- Affected: `_shared/.env`, `.env`, both `.bak` files, five reference documents,
+  ADR-002, new ADR-004. No SAP tenant was modified.
+- Decision: I left the retarget in place rather than rolling back to the
+  development tenant, because reverting would only restore access to the tenant
+  I am deliberately leaving. Restoring read access to the customizing tenant is
+  now a prerequisite for any verification, and the cheapest route is a Cloud
+  Foundry re-login — that reaches the tenant through the `mc-s4hana` destination
+  and needs no password at all, which is also what my coding standard requires.
+
+## 2026-09-29 — ADR-004: I withdraw the on-stack RAP route; development tenant parked
+
+- What changed: I corrected a tenant mislabel that had propagated through this
+  package, and on the corrected facts I withdrew ADR-002.
+  - Both `my429480` and `my431353` are tenants of the **starter system**.
+    `my429480` is its **customizing** tenant (client 100); `my431353` is its
+    **development** tenant (client 080). This package had `my429480` recorded
+    as "productive" and treated `my431353` as a separate development system;
+    both readings were wrong, and the parked credential file name
+    (`.env.prod-my429480.bak`) encoded the same error.
+  - The customizing tenant supports **key-user extensibility only** — no ABAP,
+    no RAP; developer extensibility exists only on client 080 [source:
+    fiori-tools-samples `misc/s4hana/README` "Tenant Types", verified
+    2026-09-29].
+  - I therefore parked the development tenant `my431353`, leaving all 19
+    activated `ZARENA_PLM` objects in place, and moved the application back to
+    a side-by-side runtime against released APIs.
+  - I rewrote the PRD accordingly: new target architecture, corrected
+    Systems & boundaries rows, amended acceptance test, ADR-002 marked
+    superseded, ADR-004 added, and the RAP-dependent verification items
+    (V-2, V-3, OQ-5, OQ-8, OQ-9, OQ-10) parked rather than closed (OQ-12).
+- Why: I am not carrying an ABAP/RAP build for this package, and the tenant I
+  am working in cannot host one even if I wanted to. Keeping a PRD that
+  asserted an impossible architecture would have been worse than the rebuild.
+- Affected: PRD.md (vision, target architecture, systems, decisions, open
+  questions, status), the parked tenant `my431353`, ADR-002.
+- Decision: ADR-004. I park rather than delete, so the RAP route stays
+  reversible at zero cost. I left the replacement host open as OQ-11 —
+  key-user extensibility in the tenant versus a CAP service side-by-side —
+  and recorded my recommendation for CAP, because the connectivity worker has
+  to be side-by-side regardless and one runtime beats two. I will not start
+  building until OQ-11 is decided.
+
+## 2026-09-29 — Outstanding sources committed and pushed
+
+- What changed: I committed the working-tree state that had sat uncommitted
+  since the initial `upload current sources` commit, and pushed it: `468729e`,
+  42 files, 4614 insertions, 1697 deletions, fast-forward onto `origin/main`.
+  It carries the renamed RAP handover sources (the 11 generator-suffixed
+  `zz*000` names replaced by the clean object names actually built on the
+  tenant), the `app/` rebind edits, the build record through 2026-09-19, the
+  retained reentrance-login helper and the captured live `$metadata`. It drops
+  two files that never belonged in the repository: a tracked Eclipse installer
+  under a URL-mangled filename, and a machine-specific workspace file.
+- Why: the package held six weeks of unversioned work, and I was about to
+  change direction. Nothing should be lost across that pivot.
+- Affected: the whole repository; `origin/main` now matches the working tree.
+- Decision: I committed the deletions as they stood rather than restoring
+  either file. Neither is source.
+
 ## 2026-09-18 — Reentrance-ticket login for `abap-adt-mcp`: built, tested, rejected
 
 - What changed: I built a login helper at `tools/adt-reentrance-login/`