Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

SCOPE.md

@@ -15,21 +15,28 @@ audit-core exists to provide the capability described in INTENT.md.
 
 - Maintain the repository's primary implementation.
 - Keep docs, tests, and operational metadata current.
+- Operational audit custody (`operations.audit`) and its declared recovery bound.
 
 ## Out of Scope
 
 - Own unrelated adjacent systems.
 - Make irreversible operational decisions without human approval.
+- Procuring or operating S3 / Barman / WAL.
+- Booked cost or a second usage stream for `platform:audit-storage`.
+- A `rapp.yaml` in this repo (schema requires `rapp-*`).
+- Public ingest.
 
 ## Current State
 
-- Status: active
+- Status: production
 - Production receiver on railiance01 (`namespace audit-core`), Postgres
-  append-only store on `platform-pg`, sender `user-engine`.
+  operational custody on `platform-pg`, sender `user-engine`.
 - Recovery is the platform `data.backup` window (30 days, RESOURCE-WP-0002
-  live), not an audit-core deletion window. Production still reports
-  `custody_class=archive`; AUDIT-WP-0006 is the honesty/canon-join pass.
-- Open workplan: `workplans/AUDIT-WP-0006-honest-custody-and-canon-join.md`.
+  live). Manifest `/readyz` reports `custody_class=operational` and
+  `recoverable_days=30` once the AUDIT-WP-0006 image is pinned.
+- ITC-CAP case: `data/capability/audit-core-operational.json`.
+  `data.archive` is an unmet requirement.
+- AUDIT-WP-0001…0006 closed. No open workplan.
 
 ## Getting Oriented