manna: written by the system's own hand each morning; Friday's double stands on Shabbat

Shemot 16: dvar yom b'yomo, and on the sixth day double, and none on the
seventh. Every night at 00:00Z the day's provision went stale and the
readiness probe failed until someone woke — 13.5 hours on 2026-10-15.
CronJob `manna` (deploy/k8s/manna-cronjob.yaml) runs at 00:01Z Sunday to
Friday in our own korban-processor image, mounts the manna PVC as the
app's uid, and writes today.json from the ConfigMap's MANNA_* amounts —
doubled on Friday, valid to Sunday 00:30Z. The pipeline now accepts
Friday's `double` on Saturday (validate_date/3) and nothing else across a
day boundary; three tests. The kohen sets the amounts, may still write by
hand, and reads a failed job as the Day-4 alarm (KOHEN "The manna, each
morning"; Tamid §1.1). Doorpost re-pinned. Elixir green.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -625,7 +625,26 @@ counts move without a commit to the readings is the finding.
 
 ### Friday before sunset — *Erev Shabbat*
 
-Write a **double portion** manna provision (`type: "double"`, doubled compute_units). The system will cease processing at Shabbat onset. No provision is written on Shabbat.
+The manna CronJob writes Friday's provision as a **double portion**
+(`type: "double"`, doubled compute units and external calls, valid to
+Sunday 00:30Z); the pipeline accepts Friday's double on Saturday and
+nothing else across a day boundary. The system ceases processing at
+Shabbat onset. No provision is written on Shabbat — the CronJob does not
+run on Saturday.
+
+### The manna, each morning — *Dvar yom b'yomo*
+
+Since 2026-10-15 the day's provision is written by the system's own hand:
+CronJob `manna` (`deploy/k8s/manna-cronjob.yaml`) runs at 00:01Z Sunday
+to Friday, mounts the manna PVC and writes `today.json` with the amounts
+from `shorashim-config` (`MANNA_COMPUTE_UNITS` …). Before it, every night
+at 00:00Z the old provision went stale and the readiness probe failed
+until someone woke (13.5 hours on 2026-10-15). The kohen's acts now:
+
+- set the amounts in the ConfigMap (`kubectl apply -f deploy/k8s/configmap.yaml`);
+- read `kubectl -n shorashim get jobs` after 00:01Z — a failed job is the
+  Day-4 alarm; write by hand with `kubectl cp` (Day 4) if it failed;
+- run it at once when needed: `kubectl -n shorashim create job --from=cronjob/manna manna-now`.
 
 ### If the system halts