diff --git a/persistent-memory.md b/persistent-memory.md
index 123f85f..b054f05 100644
--- a/persistent-memory.md
+++ b/persistent-memory.md
@@ -439,9 +439,25 @@ below is a live commitment or a known-open risk._
   `retire`, and `declare` from 3.5.0) live in the post office, so they fail with
   "no tool named ..." until the container carries 3.6.0. Schema gains
   `handles.retired_at` via the idempotent `_ADDED_COLUMNS` path, so the live store
-  upgrades itself on first start — no manual migration. **Not rebuilt: it is a
-  fleet-wide bus restart and wants the operator's nod.** It also blocks the
-  pending `ledger-dev` → `svos-dev` rename, which needs `declare`.
+  upgrades itself on first start — no manual migration. **REBUILT AND DEPLOYED
+  2026-09-05** on operator authorization: image
+  `claude-bot/althing-post-office:3.6.0@sha256:13158835488a8ec04f990c97c4f4c68f1d923b12494319cf07392552e68f8a78`,
+  built on nh3-dev from a clean tree at `4d26226`, pushed to the gitea registry
+  under the **claude-bot** namespace (not `vh` — package namespaces are owned).
+  **Bus down ~4 minutes, 09:35–09:39 PDT.**
+  **The backup was taken the way the compose file says to, and it mattered:** at
+  stop time `post_office.db` was 23.8 MB with a **5.9 MB WAL** — copying the .db
+  alone would have silently lost the day's mail. Stop → `PRAGMA
+  wal_checkpoint(TRUNCATE)` (WAL → 0 bytes) → copy → verify. Backup at
+  `nh3-docker:/var/backups/althing/post_office.db.pre-3.6.0-20260905`, integrity
+  `ok`, counts identical on both sides (handles 76, messages 995, recipients
+  1022). ⚠ **Reading a WAL-mode SQLite backup read-only needs `?immutable=1`, not
+  `?mode=ro`** — `mode=ro` still wants to create a `-shm` and dies with "attempt to
+  write a readonly database". Post-deploy: same counts, `handles.retired_at`
+  present, `retired 0`, and `mem=536870912` / `oom=-500` verified by `docker
+  inspect` rather than by reading the yaml, per that file's own warning.
+  `althing-operator` now offers `declare | delete | retire`, which unblocks the
+  pending `ledger-dev` → `svos-dev` rename.
 
 ## Recent decisions
 
diff --git a/stacks/althing-post-office/compose.yaml b/stacks/althing-post-office/compose.yaml
index ad5a8d7..d97217a 100644
--- a/stacks/althing-post-office/compose.yaml
+++ b/stacks/althing-post-office/compose.yaml
@@ -51,7 +51,7 @@ services:
     # Digest-pinned, not tag-floating: `:3.0.0` is a mutable pointer on a registry
     # anyone can re-push, and this container is the fleet's whole message bus. The
     # tag is kept alongside the digest purely so a human can read what it is.
-    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.0.0@sha256:410fed41fa049c41cf83577fd2e49831ea1959ca50b597a8bd35a548e267cf01
+    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.6.0@sha256:13158835488a8ec04f990c97c4f4c68f1d923b12494319cf07392552e68f8a78
     container_name: althing-post-office
 
     # ─── Host networking, so the bind guard keeps working ────────────