deploy: pin and record the schema v9 sole-pod rollout

The live StatefulSet now runs
sha256:268cccf332b3f9f6b28085f26c8649f45d2a3bfd5779b6d7ff6c5ca3edfed7a2.
A verified pre-v9 backup was migrated in isolation with unchanged counts
before the sole pod was replaced. Readiness, integrity and a single writer
were checked after the restart.

Assistant: grok
Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595

deploy/README.md

@@ -5,33 +5,36 @@ The StatefulSet is deployed as of 2026-09-14. The metadata receipt is
 storage, and an `OnDelete` update: never start two writers against a copied
 database.
 
-**Current image: pinned, published and deployed (2026-10-15).** Both `image:`
+**Current image: pinned, published and deployed (2026-11-07).** Both `image:`
 references carry
-`sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d`
-(source `a786b061da4d7730c0827cf4919ab9206aed6d3e`). Migration and server
+`sha256:268cccf332b3f9f6b28085f26c8649f45d2a3bfd5779b6d7ff6c5ca3edfed7a2`
+(source `2745cd7fdd3c6e17af38650c4a3eff1f1e003373`). Migration and server
 use identical immutable pins. The scanned image has zero HIGH/CRITICAL findings.
+Receipt: `docs/evidence/2026-11-07-schema-v9-rollout.json`.
 
-The founder-approved NK-WP-0035 release moved schema v5 to v6 and retained the
-hourly heartbeat setting. A fresh verified online backup and independent 0600
-copy preceded the controlled sole-pod replacement. The new image also opened
-and migrated an isolated production backup with unchanged record counts.
-Native readiness and v6 integrity pass; 54 approvals and 47 entries were
-preserved with zero pending outbox rows. Source defaults and interval settings
-alone do not establish elapsed-hour or independent receiver acceptance.
-Receipts: `net-kingdom/docs/evidence/2026-10-15-cadence-adoption/` files
-`approval-engine-pre-schema6-backup.json`, `approval-engine-v6-isolated-restore.json`
-and `approval-engine-schema6-rollout.json`.
+This release moves the live store from schema v6 to v9. v7 adds
+`approvals.required_assurance`, v8 adds `approvals.actor_consumes`, and v9 adds
+`revoked_by_*` plus `revocation_reason`. A verified online backup and an
+independent 0600 copy preceded the sole-pod replacement. The new image opened
+that copy, migrated it, and left the record counts unchanged. Live readiness
+and v9 integrity pass; 59 approvals, 50 entries and 2279 outbox rows were
+preserved with zero pending outbox rows. The pre-migration backup remains on
+the volume at `/data/pre-schema9-20261107.sqlite`.
 
-Schema v6 records verified `entries.tenant_source`; it does not infer legacy
-provenance. The prior v5 image was
+The previous v6 image was
+`sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d`
+(source `a786b061da4d7730c0827cf4919ab9206aed6d3e`). It refuses a v9 store:
+rollback requires the matching verified pre-v9 backup and the
+stopped-single-writer restore procedure in `docs/storage-operations.md`.
+
+The founder-approved NK-WP-0035 release had moved schema v5 to v6 on 2026-10-15
+and retained the hourly heartbeat setting. That rollout preserved 54 approvals
+and 47 entries. Receipts: `net-kingdom/docs/evidence/2026-10-15-cadence-adoption/`
+files `approval-engine-pre-schema6-backup.json`,
+`approval-engine-v6-isolated-restore.json` and
+`approval-engine-schema6-rollout.json`. The v5 image was
 `sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`.
-It refuses a v6 store: rollback requires the matching verified pre-v6 backup
-and the stopped-single-writer restore procedure in `docs/storage-operations.md`.
-Source has since moved to schema v9 (v7 `approvals.required_assurance`,
-APPROVAL-WP-0007-T01; v8 `approvals.actor_consumes`, APPROVAL-WP-0007-T02;
-v9 `revoked_by_*`, APPROVAL-WP-0007-T03); the pinned image predates schema v9
-(and v7). Deploying needs a new release, a verified pre-v7 backup and a
-founder-run rollout like the v6 one.
+It refuses a v6 store.
 
 The earlier September v5 release evidence remains historical at
 [the image evidence](../docs/evidence/2026-09-10-human-control-image.json).

deploy/approval-engine.yaml

@@ -45,7 +45,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       initContainers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/approval-engine@sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d
+          image: forgejo.coulomb.social/coulomb/approval-engine@sha256:268cccf332b3f9f6b28085f26c8649f45d2a3bfd5779b6d7ff6c5ca3edfed7a2
           args: ["migrate", "--db", "/data/approvals.sqlite"]
           securityContext:
             allowPrivilegeEscalation: false
@@ -56,7 +56,7 @@ spec:
             - {name: tmp, mountPath: /tmp}
       containers:
         - name: approval-engine
-          image: forgejo.coulomb.social/coulomb/approval-engine@sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d
+          image: forgejo.coulomb.social/coulomb/approval-engine@sha256:268cccf332b3f9f6b28085f26c8649f45d2a3bfd5779b6d7ff6c5ca3edfed7a2
           args:
             - serve
             - --production