diff --git a/deploy/sitting-admission.json b/deploy/sitting-admission.json
index 36fc3c7..14c80dc 100644
--- a/deploy/sitting-admission.json
+++ b/deploy/sitting-admission.json
@@ -3,8 +3,8 @@
   "policy": {
     "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
     "package": "informed-decision.compact-sitting",
-    "version": "v6",
-    "package_digest": "sha256:28702426ca0049500549a8acc576e70fa82e892f169e74e49cf838802447e429",
+    "version": "v7",
+    "package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
     "pod_name": "flex-auth-informed-decision-sitting"
   },
   "keycape_egress_ips": [
diff --git a/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md b/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md
index 495374d..bd4af24 100644
--- a/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md
+++ b/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md
@@ -1,7 +1,9 @@
-# p01 admission rollout candidate — awaiting founder approval
+# p01 admission rollout — deployed 2026-10-03
 
 Authority required: ADMINISTER @ realm:kubernetes/railiance01,
-activation=APPROVED, for the two changes below. No live rollout has run.
+activation=APPROVED, for the two changes below. Founder approved with
+"deploy v7" on 2026-10-03. Both changes completed; Helm revision 8 and
+review readiness verified. Previous policy Helm revision: 7.
 
 1. Helm release `flex-auth-informed-decision-sitting`, namespace `flex-auth`:
    update only its image to the CI build of access-engine commit `f946c7b`:
diff --git a/docs/batches/2026-10-03-provisioning-window/bound/index.json b/docs/batches/2026-10-03-provisioning-window/bound/index.json
new file mode 100644
index 0000000..a487854
--- /dev/null
+++ b/docs/batches/2026-10-03-provisioning-window/bound/index.json
@@ -0,0 +1,15 @@
+{
+  "kind": "informed-decision-bound-sitting",
+  "sitting_id": "infd-sitting-2026-10-03-provisioning-window",
+  "principal": "uid=platform-root,ou=people,dc=netkingdom,dc=local",
+  "submitted": false,
+  "agent_disposition_forbidden": true,
+  "memos": [
+    {
+      "memo_id": "infd-20261003-p01",
+      "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
+      "memo": "infd-20261003-p01.memo.json",
+      "packet": "infd-20261003-p01.packet.md"
+    }
+  ]
+}
diff --git a/docs/batches/2026-10-03-provisioning-window/bound/infd-20261003-p01.memo.json b/docs/batches/2026-10-03-provisioning-window/bound/infd-20261003-p01.memo.json
new file mode 100644
index 0000000..6ae6aca
--- /dev/null
+++ b/docs/batches/2026-10-03-provisioning-window/bound/infd-20261003-p01.memo.json
@@ -0,0 +1 @@
+{"approval_binding_digest":"sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4","approval_id":"706f4205-aaa7-44f6-be30-d0f57664d69c","binding":{"justification":null,"principal":{"display_name":"uid=platform-root,ou=people,dc=netkingdom,dc=local","id":"uid=platform-root,ou=people,dc=netkingdom,dc=local","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"ccr:CCR-2026-0019-delivery-proof","kind":"credential-lane","label":"secrets-engine approval-client reader, scoped delivery proof","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"Reader 1 (CCR-2026-0019, applied 2026-09-14) already ran its scoped delivery proof under the attended reader lane and the receipts say passed. RPF-WP-0035-T06 waits only on a human accepting that proof. Accepting runs nothing, delivers no credential and changes no OpenBao object. It does not close T06 by itself.","highlights":[{"id":"infd-20261003-p01-h1","item_id":"infd-20261003-p01-packet","locator":{"kind":"work_record","task":"RPF-WP-0035-T06","workplan":"RPF-WP-0035"},"note":"Known gaps you accept: the wrong-group human login is untested, and the read check used a nonexistent approval id (HTTP 404 proves authenticated routing, not a usable claim). The proof is from 2026-09-13 and is not re-run. Accepting does not close RPF-WP-0035-T06: the CCR-2026-0018 coordinated disablement still needs KeyCape and Approval Engine confirmation, and the file-delivered secret's removal depends on operator hygiene.","required_ack":true,"severity":"critical"}],"id":"infd-20261003-p01","locale":"en","packet":[{"hash":"sha256:ee53cae14ae86dbdec2936d72f99e1285b6c714d5bd322ef30df8ffbf0939ff2","item_id":"infd-20261003-p01-packet","label":"infd-20261003-p01-packet"}],"question":"Accept the passed 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader as that reader's native delivery acceptance?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1}
diff --git a/docs/batches/2026-10-03-provisioning-window/bound/infd-20261003-p01.packet.md b/docs/batches/2026-10-03-provisioning-window/bound/infd-20261003-p01.packet.md
new file mode 100644
index 0000000..5da11e0
--- /dev/null
+++ b/docs/batches/2026-10-03-provisioning-window/bound/infd-20261003-p01.packet.md
@@ -0,0 +1,64 @@
+# RPF-WP-0035-T06 — accept the CCR-2026-0019 scoped delivery proof
+
+Blocking workplan: RPF-WP-0035 (railiance-platform)
+Blocking task: RPF-WP-0035-T06 (hub prefix 68bff751)
+Hub decision: 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1, attended provisioning window)
+Design: railiance-platform `docs/credential-lane-designs/keycape-approval-client-side-readers.md`
+Request: railiance-platform `credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml` (status `applied`)
+
+## Question
+Accept the passed 2026-09-13 scoped delivery proof for the CCR-2026-0019
+secrets-engine approval-client reader as that reader's native delivery acceptance?
+
+## One act
+Record a human acceptance of a proof that has already run. Nothing executes
+because of this memo. No OpenBao, KeyCape or cluster object changes.
+
+## What already ran (reference only)
+Both under the attended reader lane, never the platform-admin lane:
+
+```sh
+warden access secrets-engine-approval-client-login --exec -- \
+  python3 /home/worsch/railiance-platform/scripts/approval-client-reader-preflight.py
+warden access secrets-engine-approval-client-login --exec -- \
+  /home/worsch/secrets-engine/.venv/bin/python -B \
+  /home/worsch/railiance-platform/scripts/approval-client-delivery-check.py
+```
+
+## Non-secret receipts (railiance-platform `docs/evidence/`)
+- `2026-09-14-ccr0019-operator-binding.json` — role/policy apply and readback
+- `2026-09-14-ccr0019-reader-preflight.json` — `status: passed`, `secret_values_read: false`
+- `2026-09-14-ccr0019-delivery-check.json` — `status: passed`, `approval_mutations: false`, `cleanup: true`
+
+## Positive evidence the owner expects
+- Exact read of `platform/data|metadata/workloads/secrets-engine/approval-client`
+- Private delivery of the existing version-1 value; private runtime file removed
+- `approval:read` token reaches Approval Engine authenticated (HTTP 404 on a fresh id)
+- Warden session exited 0 after self-revocation and helper cleanup
+
+## Negative evidence the owner expects
+- Denied: sibling `approval-engine/operator-client`, parent metadata/listing,
+  an unrelated workload path, policy read, role read
+- `approval:consume` token refused on the read route (HTTP 403); no real approval consumed
+
+## Known gaps (required acknowledgement)
+- Wrong-group human login untested.
+- The 404 read proves routing, not a usable claim on a real approval.
+- File delivery outlives the reading process; removal is operator hygiene.
+
+## Rollback / revocation (CCR-2026-0019 lifecycle)
+- Deactivate: detach policy `workload-kv-read-secrets-engine-approval-client` from
+  role `secrets-engine-approval-client-workload-kv-read`; disable the ops-warden
+  catalog entry. The KeyCape verifier lane is unaffected.
+- Compromise: KeyCape disables the `secrets-engine-approval` registration first,
+  then the value is rotated (shared with CCR-2026-0017) and the policy detached.
+
+## Not decided here
+- CCR-2026-0018 retention or coordinated disablement (KeyCape + Approval Engine
+  + Platform). T06 stays open until both owners confirm that sequence.
+- Any rotation, reseed, `approval:consume` grant, or CCR-2026-0020 (cancelled).
+
+## Must not
+- Display or paste the client secret
+- Re-run the proof as a substitute for this acceptance
+- Treat acceptance as authority for any other lane in the D1 window
diff --git a/docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json b/docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json
new file mode 100644
index 0000000..b1462e8
--- /dev/null
+++ b/docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json
@@ -0,0 +1 @@
+{"scope": "live review workload caller, synthetic reviewer; no presentations or dispositions", "policy_version": "v7", "package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7", "checks": [{"check": "exact-p01", "outcome": "allow"}, {"check": "wrong-group", "outcome": "policy_denied"}, {"check": "unknown-memo", "outcome": "policy_denied"}, {"check": "changed-digest", "outcome": "policy_denied"}, {"check": "no-caller-token", "http": 401}], "decision_attributable": false}
diff --git a/docs/evidence/2026-10-03-provisioning-window-review-readiness.json b/docs/evidence/2026-10-03-provisioning-window-review-readiness.json
new file mode 100644
index 0000000..effff3e
--- /dev/null
+++ b/docs/evidence/2026-10-03-provisioning-window-review-readiness.json
@@ -0,0 +1,15 @@
+{
+  "origin": "https://decisions.coulomb.social",
+  "healthz": {
+    "http": 200,
+    "status": "ok"
+  },
+  "readyz": {
+    "http": 200,
+    "status": "ready"
+  },
+  "auth_start": {
+    "http": 303,
+    "location_host": "kc.coulomb.social"
+  }
+}
diff --git a/docs/evidence/2026-10-03-provisioning-window-v7-rollout.json b/docs/evidence/2026-10-03-provisioning-window-v7-rollout.json
new file mode 100644
index 0000000..0c49321
--- /dev/null
+++ b/docs/evidence/2026-10-03-provisioning-window-v7-rollout.json
@@ -0,0 +1,68 @@
+{
+  "observed_at": "2026-10-03T18:02:15.288390+00:00",
+  "authority": {
+    "mode": "ADMINISTER",
+    "scope": "realm:kubernetes/railiance01",
+    "activation": "APPROVED",
+    "source": "founder instruction: deploy v7"
+  },
+  "policy": {
+    "helm_revision": 8,
+    "previous_revision": 7,
+    "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d",
+    "generation": 8,
+    "available_replicas": 1
+  },
+  "review": {
+    "configmap": "informed-decision-runtime-b800648bd80b",
+    "previous_configmap": "informed-decision-runtime-5c11925287fa",
+    "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
+    "generation": 16,
+    "available_replicas": 1
+  },
+  "checks": {
+    "scope": "live review workload caller, synthetic reviewer; no presentations or dispositions",
+    "policy_version": "v7",
+    "package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
+    "checks": [
+      {
+        "check": "exact-p01",
+        "outcome": "allow"
+      },
+      {
+        "check": "wrong-group",
+        "outcome": "policy_denied"
+      },
+      {
+        "check": "unknown-memo",
+        "outcome": "policy_denied"
+      },
+      {
+        "check": "changed-digest",
+        "outcome": "policy_denied"
+      },
+      {
+        "check": "no-caller-token",
+        "http": 401
+      }
+    ],
+    "decision_attributable": false
+  },
+  "origin": {
+    "origin": "https://decisions.coulomb.social",
+    "healthz": {
+      "http": 200,
+      "status": "ok"
+    },
+    "readyz": {
+      "http": 200,
+      "status": "ready"
+    },
+    "auth_start": {
+      "http": 303,
+      "location_host": "kc.coulomb.social"
+    }
+  },
+  "memo_loaded": false,
+  "human_disposition_created": false
+}
diff --git a/workplans/ADHOC-2026-10-03.md b/workplans/ADHOC-2026-10-03.md
index 79ce908..d4dd866 100644
--- a/workplans/ADHOC-2026-10-03.md
+++ b/workplans/ADHOC-2026-10-03.md
@@ -40,7 +40,7 @@ id: INFD-WP-ADHOC-2026-10-03-T02
 status: wait
 needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "Attended approval creation complete; remaining: publish and deploy exact-record policy v7, load pinned memo, and founder human disposition at decisions.coulomb.social."
+blocking_reason: "Approval creation and v7 policy/review rollout complete; remaining: load p01 for the verified human recipient, then founder disposition at decisions.coulomb.social."
 priority: high
 state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
 ```
@@ -80,3 +80,24 @@ Deployment values are pinned in access-engine commit `20ea612`.
 `docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md` records the concrete
 policy/review rollout candidate, namespace-scoped preflight and rollback.
 Live rollout awaits founder approval. Load and human disposition remain open.
+
+
+A4 live rollout completed on founder instruction "deploy v7":
+ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
+Helm revision 8 is deployed; authenticated workload live checks permit exact
+p01 and refuse wrong group, unknown memo, changed digest and absent caller
+token. Review Deployment references `informed-decision-runtime-b800648bd80b`;
+public health/readiness return 200 and sign-in redirects to KeyCape (303).
+`deploy/sitting-admission.json` now declares the deployed v7 pin.
+Evidence: `docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json`
+and `docs/evidence/2026-10-03-provisioning-window-review-readiness.json`.
+A5 load and A6 human disposition remain outstanding; no presentation or
+human act was performed by the rollout or probes.
+
+A5 preparation: the existing live presentation records identify one historical
+KeyCape reviewer subject, `uid=platform-root,ou=people,dc=netkingdom,dc=local`.
+Pinned memo/packet copies for this recipient are prepared under the sitting's
+`bound/` directory. A temporary offline-store load passed with no presentations
+or dispositions. Live store inspection confirms p01 is not yet loaded. The
+approved rollout covered policy and review configuration; live memo loading
+remains a separate pending step.