docs: record migration head 0020 in the release manifest and docs

RELEASE_MANIFEST.json still said head 0011 (repo was at 0018, now 0020)
and RELEASE_CANDIDATE_V1.md said 0010. Updated both, plus
AI_PROJECT_STATE.md and PILOT_DEPLOYMENT.md, to head
0020_not_null_timestamps as applied in production.

scripts/release_manifest.py reported the 4-digit file prefix as the head
("0020" instead of "0020_not_null_timestamps") and always read the
applied revision from the dev container. It now asks Alembic for the real
head and revision count, and the Hub container is configurable
(HUB_CONTAINER); the source is recorded in the manifest.

tests/test_release_candidate.py now fails when the manifest head differs
from Alembic's head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/AI_PROJECT_STATE.md

@@ -440,7 +440,7 @@ allowlist and the fiscal rule engines still decide what may actually be written
 Hub `classification_cache` fixed: fingerprint (tenant + input + ENGINE_VERSION + dataset_versions()) is computed first and a HIT returns without running the Classifier (test: `central/tests/test_classification_cache.py`). Live benchmark (100 products): MISS 337 ms/product, HIT 15 ms/product, 100/100 hits, identical results. Fingerprint inputs unchanged, so existing cache entries stay valid and version bumps still invalidate naturally.
 
 ## Release Candidate 1.0.0-rc1 (2026-09-19) — COMPLETE_LOCAL_RC
-Frozen: `release/VERSION`, `central/app/version.py` (`GET /version`), `release/RELEASE_MANIFEST.json` (versions + ACTIVE dataset hashes + migrations 0001..0010). See `docs/RELEASE_CANDIDATE_V1.md`.
+Frozen: `release/VERSION`, `central/app/version.py` (`GET /version`), `release/RELEASE_MANIFEST.json` (versions + ACTIVE dataset hashes + migrations; head `0020_not_null_timestamps` since 2026-09-23). See `docs/RELEASE_CANDIDATE_V1.md`.
 Architecture: Hub central (Docker Hub+PostgreSQL, `deploy/hub`) <-HTTPS- Agent Windows (`deploy/agent-windows`, service GTIFiscalAgent) -local read-only-> SGV Firebird. The Hub never accesses Firebird.
 Agent: `FISCAL_MODE` DRY_RUN|AUTO_APPLY (DRY_RUN = technically no writes), `COMPANY_CODE/COMPANY_CNPJ/COMPANY_CRT_SOURCE(AUTO|EMISSOR|C000004)`, `COMPANY_UF` explicit override only; single preflight `agent/scripts/preflight.py` (also enforced at service start); REPROCESS_ALL job result includes the coverage report + company context (`gti_fiscal_agent/coverage.py`, shared with multi-db tooling); `scripts/prove_zero_write.py` (DML counters + table digests). Packaging: `scripts/build_agent_package.py` (secret-scanned zip). Hub prod: `deploy/hub/docker-compose.prod.yml` (Postgres internal only), backup/restore, dataset seed export/import; `APP_ENV=production` refuses AGENT_DEV_TOKEN.
 Pilot profile: CONSTRUCAO (`pilot-construcao.env.example`); planned, not installed: MMMODAS/RINCAO/UNIAO with `COMPANY_CRT_SOURCE=EMISSOR`. No real host was accessed: a local simulation ran the Agent (registered agent, DRY_RUN) end-to-end on the CONSTRUCAO copy. Follow-up: memoize `dataset_versions()`.
@@ -476,3 +476,19 @@ context. Retrieval V3 evidence hooks exist but V2 remains active until a full
 untouched holdout replay proves no regression. Human/group questionnaire CLIs,
 guarded rollback preview, local validation, and health report are available.
 See `docs/PRE_AI_LOCAL_COMPLETION_V3_REPORT.md` for measured values.
+
+## Production Hub + migration baseline (2026-09-23)
+
+- Hub + PostgreSQL run on VM 10.0.10.117 (`deploy/hub`, compose project
+  `gti-fiscal-hub`), next to the GTI Gerenciador but isolated (own DB, process,
+  login). TLS via Caddy on 443 only; HTTPS still waits on public DNS.
+- Migration head: `0020_not_null_timestamps`. An empty database is initialized
+  by `alembic upgrade head` alone — never `stamp`/`create_all`.
+- `0001` is a frozen explicit baseline (it used to call `create_all()`, which
+  broke every fresh install). `0019` fixes the frozen `created_at` defaults
+  from `0006`; `0020` enforces NOT NULL on 20 defaulted timestamps.
+- Verified: fresh DB == upgraded real-history DB == production (pg_dump);
+  vs models, 0 differences on nullability/types/PK/FK/uniqueness/checks.
+  Remaining drift is naming, column order, extra DB defaults, redundant indexes.
+- `deploy/hub/*.sh` are forced to LF (`.gitattributes`); `backup.sh` + restore
+  into a scratch database were exercised on production.

docs/PILOT_DEPLOYMENT.md

@@ -130,6 +130,10 @@ Agents with `central/scripts/register_agent.py` (see below).
 - `0019` repairs `agents.created_at/updated_at` and `jobs.created_at`, whose
   defaults `0006` had frozen at the instant it ran (rows created before `0019`
   keep that frozen value — their real creation time is not recoverable).
+- `0020` enforces NOT NULL on 20 timestamp columns that always had
+  `DEFAULT now()`. It aborts, changing nothing, if any NULL exists — clean
+  those rows explicitly first. Current head: `0020_not_null_timestamps`
+  (also recorded in `release/RELEASE_MANIFEST.json`).
 
 ### HTTPS / reverse proxy
 

docs/RELEASE_CANDIDATE_V1.md

@@ -19,7 +19,7 @@ The Hub never accesses Firebird and never stores Firebird credentials or paths.
 | GTI_FISCAL_VERSION (Hub, Agent, packages) | 1.0.0-rc1 (`release/VERSION`, `central/app/version.py`, `GET /version`) |
 | fiscal engine (`ENGINE_VERSION`) / decision (`DECISION_VERSION`) | 0.3.0 / mission-04c-ipi-ex-split (unchanged: no fiscal semantics touched) |
 | decision engines | fiscal-decision-v1, product-defaults-v1, icms-context-v1 |
-| migrations | 0001..0010 (head 0010, applied) |
+| migrations | 0001..0020 (head `0020_not_null_timestamps`, applied in production 2026-09-23; a fresh database is initialized by `alembic upgrade head` alone) |
 | datasets | 13 ACTIVE kinds with sha256/record_count in the manifest |
 
 ## What RC1 adds (no fiscal rule changes)