DL-542
The Server renderer names Secrets but holds no values; Server secrets are read through dotenv:// from a read-only mounted Secret file whose master key never changes, forge App ids and secret names render as –forge-* args, XDG_STATE_HOME and the state dir sit on an emptyDir, and the admin token Secret mounts directly at 0440 under pod fsGroup 65532 with no init container, which the Server accepts once it follows the volume symlink and allows group-read for a group it holds.
Status: Active (Matt, 2026-10-17)