docs(evidence): record activity-core b186746 production release

Live /release/health now healthy:true. Closes the deploy note on
ACTIVITY-WP-ADHOC-2026-10-19-T03. Rollback: Argo 8884b123, sha256:08966e8d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 244572@bnt-lap001
Assistant-Session: 3b235e1a-ae45-4d0f-ae70-17a9bd78ece8

docs/evidence/2026-10-20-release-health-probe-release.json

@@ -0,0 +1,74 @@
+{
+  "observed_at": "2026-10-19T22:52:49Z",
+  "authorization": {
+    "approved_by": "founder (Bernd), 2026-10-20, attended release from origin/main",
+    "candidate_choice": "origin/main head b186746 (build-and-push run 434 success)"
+  },
+  "executed_by": "activity-core release agent (Claude Code): review gate, pin commit, railiance-platform pin commit, Argo child patch+sync (prune=false), read-only and operator post-checks",
+  "carries": {
+    "b186746": "/release/health probe fix: per-cadence report sinks, absent catchup_window_seconds accepted (ACTIVITY-WP-ADHOC-2026-10-19-T03)"
+  },
+  "review_gate": {
+    "range": "9a46350..b186746 (8 commits)",
+    "code_commits": {
+      "9ef75e0": "adds src/activity_core/custodian_capture.py (+tests, SCOPE.md, k8s/custodian-release/RESTART.md). Now in the image but not imported by the API, worker, activities or any operation registry; no schedule, env, mount, RBAC or migration. Inert; admitted.",
+      "b186746": "release_health.py probe logic only (read-only GET /release/health); admitted, purpose of the release"
+    },
+    "manifest_changes_beyond_images": "none (8884b12 image pins only; RESTART.md is documentation outside k8s/gitops)",
+    "migrations": "none",
+    "inert": [
+      "custodian_capture.py shipped but unwired",
+      "k8s/custodian-release worker-patch.yaml and publisher-access-delta.md still not referenced by k8s/gitops",
+      "release runtime/sampler not started; release broker (ACTIVITY-WP-0041-T03) not used"
+    ]
+  },
+  "image": {
+    "tag": "git-b186746f4a92f9385c16a3c298e27739fa8271a4",
+    "digest": "sha256:2f5084655463294ef2f8e8251f4ef16db049dcbba488da1e700f2fdacca7362a",
+    "ci": "Build and Publish Container Image / build-and-push run 434 success 2026-10-19T22:38:48Z; CI Smoke run 433 host-smoke and container-smoke success",
+    "anonymous_pull": "manifest 200 via anonymous registry token",
+    "components": ["actcore-api", "actcore-worker"],
+    "event_router": "unchanged, sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4"
+  },
+  "retention": "make refresh-live-images with EXTRA_LIVE_FILES listing 2f508465 (candidate), 08966e8d and cd4e924c (rollback/live); union 101 images, sha256 f18ea699...",
+  "release_commit": "1fe2fcc0d51c086db00d5f4d8b4e2fadb1d89a1d",
+  "platform_pin": {
+    "repo": "railiance-platform",
+    "file": "argocd/railiance01/applications/activity-core.application.yaml",
+    "commit": "e7bc778784964fc3ed140cfb67a9ae2b3601f370",
+    "note": "committed and pushed before the live child patch"
+  },
+  "argo": {
+    "application": "argocd/activity-core",
+    "previous_revision": "8884b123c54877bec44fb8355792244a8353a8ff",
+    "revision": "1fe2fcc0d51c086db00d5f4d8b4e2fadb1d89a1d",
+    "method": "kubectl patch of child spec.source.targetRevision plus sync operation prune=false, ApplyOutOfSyncOnly (as 2026-10-19); root railiance-apps-root not synced",
+    "sync_result": "Deployment/actcore-api configured, Deployment/actcore-worker configured; nothing else",
+    "status": "Synced Healthy",
+    "pin_drift": "make argocd-pin-drift: all 9 children ok (activity-core 1fe2fcc0d51c)"
+  },
+  "previous_images": {
+    "api": "sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66",
+    "worker": "sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66",
+    "event_router": "sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4"
+  },
+  "post_checks": {
+    "rollouts": "api, worker, event-router successfully rolled out; api/worker running imageID == 2f508465, 0 restarts",
+    "health": {"status": "ok", "db": true, "temporal": true},
+    "release_health": {
+      "response": {
+        "schema_version": "activity-core-release-health/v1",
+        "healthy": true,
+        "definition_count": 3,
+        "schedule_count": 3,
+        "definitions_and_report_sinks_match": true,
+        "schedules_match": true
+      },
+      "assessment": "probe fix effective; closes ACTIVITY-WP-ADHOC-2026-10-19-T03"
+    },
+    "expire_leases": {"reopened": 0, "expired": 0, "method": "POST from inside the api pod with the pod's operator token env; token value not read"},
+    "worker_logs_5m": "no errors (sync_schedules complete, errors=0)",
+    "admin_sync": "not run (no ConfigMap change in this release)"
+  },
+  "rollback": "set the child targetRevision and the railiance-platform pin back to 8884b123c54877bec44fb8355792244a8353a8ff (api/worker sha256:08966e8d) and sync with prune=false"
+}

workplans/ADHOC-2026-10-19.md

@@ -83,5 +83,11 @@ accept a missing `catchup_window_seconds` when the schedule enforces it.
   Temporal `catchup_window` separately. No admin definition sync is needed.
 - Two new tests cover these cases. The full suite passes (877 passed,
   1 skipped).
-- Not deployed: the fix ships with the next image release, and live
-  `/release/health` stays false until then.
+- Deployed 2026-10-20 (founder-approved attended release): image
+  `git-b186746f4a92f9385c16a3c298e27739fa8271a4` (sha256:2f508465) on api and
+  worker, Argo child and railiance-platform pin at `1fe2fcc` (railiance-platform
+  `e7bc778`). Live `GET /release/health` now returns `healthy:true`,
+  definition_count 3, schedule_count 3, definitions_and_report_sinks_match
+  true, schedules_match true. Evidence:
+  `docs/evidence/2026-10-20-release-health-probe-release.json`. Rollback: Argo
+  revision `8884b123`, api/worker sha256:08966e8d.