docs(evidence): record activity-core 9a46350 production release

api and worker on sha256:08966e8d via Argo 8884b12, Synced Healthy.
ADHOC-2026-10-19-T02 done; T03 residual for the /release/health probe
contract. ACTIVITY-WP-0046-T03 still waits on assembly-economics v2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 244572@bnt-lap001
Assistant-Session: 3b235e1a-ae45-4d0f-ae70-17a9bd78ece8

docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json

@@ -0,0 +1,62 @@
+{
+  "observed_at": "2026-10-19T21:34:04Z",
+  "authorization": {
+    "approved_by": "founder (Bernd), 2026-10-19, attended release from origin/main",
+    "candidate_choice": "founder chose the existing 9a46350 image after build-and-push run 427 for head 9ef75e0 failed on a transient PyPI timeout (hatchling); CI not re-run, 9ef75e0 not promoted"
+  },
+  "executed_by": "activity-core release agent (Claude Code): review gate, pin commit, Argo child patch+sync (prune=false), read-only and operator post-checks",
+  "carries": {
+    "9737577": "repository grant v2 publish scope (ACTIVITY-WP-0046)",
+    "42347da": "ops_run lease-expiry ceiling, terminal expired (ACTIVITY-WP-ADHOC-2026-10-19)"
+  },
+  "review_gate": {
+    "range": "34d1dc5..9ef75e0 (40 commits incl. pushed f718108, 9ef75e0)",
+    "runtime_yaml_beyond_images": "none at release time; f9f2640 assembly-checkpoint ConfigMap (founder-approved 2026-10-12) was already live (Argo at f9f2640)",
+    "migrations": "none; ops_runs.state is Text without constraint, expired needs no migration",
+    "inert": [
+      "daily-security-flow and weekly-railiance-allocation-review definitions enabled:false/status:proposed (not synced)",
+      "k8s/custodian-release command bundle and input policy baked into image as hash-verified files only; worker-patch.yaml and publisher-access-delta.md not referenced by k8s/gitops",
+      "release runtime/sampler not started; release broker (ACTIVITY-WP-0041-T03) not used",
+      "custodian_capture.py (9ef75e0) not in the shipped image"
+    ],
+    "new_surface": "GET /release/health (read-only)"
+  },
+  "image": {
+    "tag": "git-9a46350bb3e1192b76aab859218f95312e17fdf4",
+    "digest": "sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66",
+    "ci": "build-and-push for 9a46350 success 2026-10-19T13:33:14Z",
+    "anonymous_pull": "manifest 200 via anonymous registry token",
+    "components": ["actcore-api", "actcore-worker"],
+    "event_router": "unchanged, sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4",
+    "revision_note": "image revision 9a46350 differs from the source revision Argo tracks (8884b12); 9a46350..8884b12 changes only workplans/WORK-RECORDS, 9ef75e0 (custodian_capture.py, not in image) and the two image pins"
+  },
+  "retention": "make refresh-live-images with EXTRA_LIVE_FILES listing 08966e8d (candidate), fdc631d7 and cd4e924c (rollback/live); union 100 images, sha256 da0a1e3e...",
+  "argo": {
+    "application": "argocd/activity-core",
+    "previous_revision": "f9f2640f38511d592bcdac47bef379333075ea46",
+    "revision": "8884b123c54877bec44fb8355792244a8353a8ff",
+    "method": "kubectl patch of child spec.source.targetRevision plus sync operation prune=false, ApplyOutOfSyncOnly (as 2026-10-04); root railiance-apps-root not synced",
+    "sync_result": "Deployment/actcore-api configured, Deployment/actcore-worker configured; nothing else",
+    "status": "Synced Healthy"
+  },
+  "previous_images": {
+    "api": "sha256:fdc631d7a154e3ae57098ae8c6e5a399617c3180859971f5d5269ee33e93ff2c",
+    "worker": "sha256:fdc631d7a154e3ae57098ae8c6e5a399617c3180859971f5d5269ee33e93ff2c",
+    "event_router": "sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4"
+  },
+  "post_checks": {
+    "rollouts": "api, worker, event-router successfully rolled out; api/worker running imageID == 08966e8d, 0 restarts",
+    "health": {"status": "ok", "db": true, "temporal": true},
+    "expire_leases": {"reopened": 0, "expired": 0},
+    "schedules": "frontend-patterns daily/weekly/monthly Temporal schedules unpaused; schedule_matches true for all three (catchup 1 day, BUFFER_ONE, RunActivityWorkflow on orchestrator-tq); daily last fired 2026-10-19T00:00Z",
+    "report_sinks": "DB definitions carry the source sinks: daily fep_feedback_intake, weekly fep_improvement_review, monthly fep_monthly_review (topic fe2aaa78)",
+    "release_health": {
+      "response": {"healthy": false, "definition_count": 3, "schedule_count": 0, "definitions_and_report_sinks_match": false, "schedules_match": false},
+      "assessment": "probe defect, not a release regression; not a rollback trigger. definition_matches() requires trigger_config.catchup_window_seconds (DB rows, unchanged since 2026-09-27, lack it; catchup is enforced on the schedules) and hardcodes the fep_feedback_intake sink for all three, while weekly/monthly use their own event types. First live run of this endpoint; the rollback image does not have it.",
+      "residual": "ACTIVITY-WP-ADHOC-2026-10-19-T03"
+    },
+    "worker_logs_10m": "no errors",
+    "admin_sync": "not run (no ConfigMap change in this release)"
+  },
+  "rollback": "pin api/worker back to sha256:fdc631d7 (or set the child targetRevision back to f9f2640f38511d592bcdac47bef379333075ea46) and sync with prune=false"
+}