change desc

docs/deployment.md

@@ -41,8 +41,8 @@ For a private package, configure Komodo's Registry provider/account for
 `gitea.cptckp.com` with a token allowed to read the image. Keep these credentials
 separate from the CI write token.
 
-Before deploying, transfer your trusted initial SQL dump to the Docker host and
-set `DB_INIT_SQL_PATH` as described below. Deploy the Stack: startup waits for
+Before deploying, set `DB_INIT_SQL_PATH` to the tracked repository dump or a
+separately transferred private file, as described below. Deploy the Stack: startup waits for
 MySQL, runs `db-init`, runs `migrate`, then starts the app. The one-shot services
 should finish with exit code 0; they do not remain running.
 
@@ -54,22 +54,28 @@ Official reference: [Komodo Compose Stacks](https://komo.do/docs/deploy/compose)
 
 ## 2. Automatic database initialization
 
-Obtain a trusted recruitment SQL export containing `in_daper`, `in_soal`, and
-`in_jawab`. Transfer it privately to the **Docker host**, outside the
-checkout/document root, for example `/srv/recruitment-private/initial.sql`.
-Restrict access to the file and set this in the Stack Environment (or `.env`):
+The initial dump `DB/recruitment_local_2026-10-14.sql` is tracked in this repository.
+The `recruitment-hc` Komodo Stack and `.env.example` use a read-only mount from the
+repository checkout, so no separate upload is required:
 
 ```dotenv
-DB_INIT_SQL_PATH=/srv/recruitment-private/initial.sql
+DB_INIT_SQL_PATH=./DB/recruitment_local_2026-10-14.sql
 ```
 
-For local Docker use, the default is
-`./DB/recruitment_local_2026-10-14.sql`. That dump contains personal data and
-existing accounts, not just schema. Review/sanitize production exports and remove
-unwanted demo/test access before opening the site. Dumps are not shipped in the
-app image or fetched from Git. The file is mounted read-only into `db-init`;
-it must exist on the Docker host even on later deployments. A missing path fails
-startup instead of silently creating a directory. Dumps must not reference the
+The relative path resolves on the **Docker host** within the checked-out Compose
+project, not on your local computer. Ensure the deployed commit includes the dump.
+It contains personal data and existing accounts, not just schema: keep repository
+access restricted, review/sanitize production exports, and remove unwanted
+demo/test access before opening the site. The SQL is excluded from the app image.
+
+To use a different trusted export containing `in_daper`, `in_soal`, and `in_jawab`,
+transfer it privately to a path outside the checkout/document root, for example
+`/srv/recruitment-private/initial.sql`, and change `DB_INIT_SQL_PATH` to that
+absolute path. It must exist on the Docker host, not merely in a container or on
+your computer.
+
+The file is mounted read-only into `db-init` and must exist on every deployment.
+A missing path fails startup instead of silently creating a directory. Dumps must not reference the
 reserved `rec_bootstrap_state` safety table; exclude it from exports/backups using
 the command in section 5. This prevents a restored marker from masking a failed
 import.