docs: record Binky OpenBao runtime repair

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf

workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: activity-core
 created: "2026-08-20"
-updated: "2026-08-21"
+updated: "2026-09-04"
 related:
   - ACTIVITY-WP-0021
   - ACTIVITY-WP-0022
@@ -180,6 +180,17 @@ duplicate registrar IDs, and railiance-master for the unclaimed retention
 closeout. The expired retention one-shot is disabled; its existing open ops run
 remains operator-visible and cannot authorize destructive cleanup.
 
+Progress 2026-09-04: the Binky mail lane was already provisioned; its runtime
+discovery was broken. OpenBao was healthy, OpenBao v2.5.4 existed at
+`/home/tegwick/.local/bin/bao`, and the mode-0600 AppRole files existed under
+`~/.local/rein-aharness/approle-binky-mail`, but the rein claim-loop omitted
+both locations. `rein-aharness` commit `aedfadd` now supplies the non-secret
+OpenBao/AppRole defaults and includes `~/.local/bin` in `PATH`. The corrected
+unit is live and healthy. A value-free smoke proved `read` on the exact Binky
+IMAP path, `deny` on a sibling path, and presence of both required IMAP fields;
+the rein suite passed 224 tests with one skip. T05 remains `wait` only for its
+other named external metadata/retention handoffs.
+
 ## Acceptance
 
 - [x] Weekly SBOM fan-out is disabled in source and production