Pin compact sitting v3 on the dedicated release (revision 3).

Operator-applied helm upgrade on railiance01 serves CI image main-ad7b7f5,
sha256:bd616cc2efcefa4951156f1fe2a3ead6c8ced76b2f60e0c38cd37ba82e35cbde. Its baked
package is byte-identical to the committed v3, and its own binary computes
package digest sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655,
matching FLEX-DEC-2026-017. The rendered change against revision 2 was one line,
the image; live values equalled this file. Rollout complete, one pod, no restarts.

Not verified: a live check through the enforced caller path, which only
informed-decision's service account can make. Its first real list call is that
check. Rollback is revision 2.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d

values/informed-decision-sitting.yaml

@@ -1,10 +1,10 @@
 # Compact sitting exact-record human review. Distinct from
 # values/informed-decision-t03.yaml / FLEX-WP-0027.
-# CI image of 4f66c4d (examples/informed-decision-sitting v2).
+# CI image of ad7b7f5 (examples/informed-decision-sitting v3, FLEX-DEC-2026-017).
 name: flex-auth-informed-decision-sitting
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:d77378e1a3d42326ea1b169209776d04b140567dfb64bc7b64567cfb515c114f
+  digest: sha256:bd616cc2efcefa4951156f1fe2a3ead6c8ced76b2f60e0c38cd37ba82e35cbde
 args:
   - serve
   - --addr

workplans/FLEX-WP-0032-informed-decision-list-action.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Admit a list action for the informed-decision overview without handing the scope to the consumer"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 flavor: implementation
 owner: claude
 topic_slug: netkingdom
@@ -152,7 +152,7 @@ record's own version. Test-only; no policy change.
 
 ```task
 id: FLEX-WP-0032-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "2a296df6-1d39-5b3e-9312-8e791a6ccbd0"
 ```
@@ -160,3 +160,20 @@ state_hub_task_id: "2a296df6-1d39-5b3e-9312-8e791a6ccbd0"
 Owner: `flex-auth` publishes the package, version and digest; informed-decision
 updates its admission input. **Deploying the pin is a production change to a
 live human-review surface and is confirmed with the operator before it runs.**
+
+2026-09-21: done. Operator confirmed and applied the upgrade: release
+`flex-auth-informed-decision-sitting` revision 3 on railiance01, image
+`main-ad7b7f5` = `sha256:bd616cc2efcefa4951156f1fe2a3ead6c8ced76b2f60e0c38cd37ba82e35cbde`.
+
+Verified before rollout: the image's baked package is byte-identical to the
+committed v3; the image's own binary computes package digest
+`sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655`; live
+release values equalled the committed file; the rendered diff against revision 2
+was exactly one line, the image digest. Verified after: rollout complete, one pod
+Running on `bd616cc2…`, zero restarts.
+
+**Not verified:** a live `/v1/check` through the enforced caller path. The pin
+admits only informed-decision's service account, and minting its token to test
+as it is not ours to do. informed-decision's first real `list` call is that
+check, and a mismatch there is a finding. Rollback:
+`helm rollback flex-auth-informed-decision-sitting 2 -n flex-auth`.