SPECS: server 2.6.2 running; the car updated itself to 2.35.3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

SPECS.md

@@ -39,8 +39,8 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go)
 
 ### Status
 
-Current: app 2.35.3; server 2.6.2 pinned by digest in `k8s/server.yaml` (2.6.1 running on the
-cluster until it is applied).
+Current: app 2.35.3 (installed on the car over the air), server 2.6.2 (pinned by digest in
+`k8s/server.yaml`; applied and running since 2026-10-25).
 
 - [x] On the car: QR pairing, values on the Overview, voice-key double press, full screen
       without black bands.
@@ -147,7 +147,8 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   intermediate certificates, `crypto/x509`, reached through the server's TLS); now no
   vulnerabilities, in the source and in the built binary. go vet, tests, podman build. Pushed
   as `mg4-server:2.6.2` (`sha256:e4de1e75…`, checked in the registry) and pinned in
-  `k8s/server.yaml`.
+  `k8s/server.yaml`. Applied by the owner, together with the real `FORGE_TOKEN`: the car then
+  updated itself to 2.35.3 over the air (owner, 2026-10-25).
 - 2026-10-25 — `k8s/influxdb.yaml`: the values Kubernetes fills in itself are written out — the
   NetworkPolicy port's `protocol: TCP`, and `apiVersion`, `kind` and `volumeMode: Filesystem` on
   the StatefulSet's volume claim template. Without them every `kubectl apply -k k8s/` reported