README.md

@@ -1012,10 +1012,12 @@ Only `config.yml` and `passkey.pem` in it are not generated; storage is in-memor
 - 2026-11-03: 7.3.2 → 7.5.0 (GHSA-5c49-6fvm-2xvc: `/metrics` exposed webhook URLs, plus two DoS fixes).
   Old build kept at `/opt/hookshot-7.3.2`.
 
-## Call Stack Upgrade (lk-jwt-service 0.4.1 → 0.9.0, LiveKit 1.9.11 → 1.13.11) — planned
+## Call Stack Upgrade (lk-jwt-service 0.4.1 → 0.9.0, LiveKit 1.9.11 → 1.13.11) — done 2026-11-03
 
-Tested on the local stack on 2026-11-03 (calls through the guard, voice-bridge e2e audio both ways,
-encrypted and not). Required changes, all on LXC 151:
+Tested on the local stack, then applied on LXC 151 on 2026-11-03 with release binaries (sha256-checked).
+Rollback: `/usr/local/bin/lk-jwt-service.0.4.1`, `/usr/local/bin/livekit-server.1.9.11`,
+`/etc/livekit/config.yaml.bak-20261103`, and drop the `LIVEKIT_SANITY_CHECK_INTERVAL_SECONDS` line from
+`/etc/systemd/system/lk-jwt-service.service.d/override.conf`. The changes:
 
 1. **lk-jwt-service 0.9.0** (a Rust rewrite; fixes GHSA-rq24-fh66-rq7x). Existing env vars carry over.
    Add `LIVEKIT_SANITY_CHECK_INTERVAL_SECONDS=30`.
@@ -1228,8 +1230,8 @@ All commands use the `!` prefix. Run `!help` in any room for the full list.
 | Homeserver | Synapse | 1.159.0 |
 | Database | PostgreSQL | 17.9 |
 | TURN | coturn | latest |
-| Video/voice calls | LiveKit SFU | 1.9.11 |
-| LiveKit JWT | lk-jwt-service | 0.4.1 (0.9.0 planned, see *Call stack upgrade*) |
+| Video/voice calls | LiveKit SFU | 1.13.11 |
+| LiveKit JWT | lk-jwt-service | 0.9.0 |
 | Moderation | Draupnir | 2.9.0 |
 | SSO | Authelia (OIDC) + LLDAP | — |
 | Webhook bridge | matrix-hookshot | 7.5.0 |