diff --git a/.custodian-brief.md b/.custodian-brief.md
index e286ce6..db23e1e 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -18,9 +18,9 @@ Open tasks:
 - T08/T09 — extend the four-repository pilot after owner feedback; publish and track fleet reach
 - T10 — verify the full completion contract
 
-T01, T03, T04 and T06 are done. Status: active. Release 0.2.1 is a working
+T01, T03, T04 and T06 are done. Status: active. Release 0.2.2 is a working
 non-normative pilot; the repository includes CLI, source inventory, cards, adapters,
-export/rollback tooling, 327 portable tests and 9 optional real owner-contract tests.
+export/rollback tooling, 332 portable tests and 9 optional real owner-contract tests.
 The decisions/runbooks cards, unsigned adoption draft and native orientation
 pack link informed-decision and runbook-tutorials without assuming their pending
 intake or execution features. See `docs/evidence/` and
@@ -47,3 +47,12 @@ Owner-review workers started at the user's request: doctrine_adoption
 (gate-house/net-kingdom/security-canon), whitehat_review (whitehat-security),
 and runtime_distribution (access-engine/glas-harness/the-custodian).
 T02/T05/T07/T09 are in progress; T08/T10 still wait for acceptance evidence.
+
+
+Current checkpoint: docs/evidence/2026-10-03-owner-reviews-and-022-fixes.md.
+Owner reviews delivered; 0.2.2 fixes Whitehat's two loaded-package consistency
+findings. 341 tests pass and all source files verify after the reviewed Glas
+metadata-source refresh. Whitehat review close-out was platform-blocked; human
+adoption and provider/continuity/pilot/rollout evidence remain open. Workers
+continue current-release provider diagnosis, pilot owner feedback and attended
+Informed Decision submission-route review.
diff --git a/SCOPE.md b/SCOPE.md
index d41167a..6e02f2a 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -29,9 +29,9 @@ decisions without widening privilege, and keep root human-controlled.
 ## Current State
 
 - Canon and reference package: v0.8; Python 3.11+, PyYAML, pytest.
-- Knowledge package: v0.2.1 pilot; 14 cards, 24 owners, 69 pinned sources,
+- Knowledge package: v0.2.2 pilot; 14 cards, 24 owners, 69 pinned sources,
   read-only retrieval CLI, sealed exports and provider adapters.
-- Verification: 327 portable tests plus 9 optional real owner-contract tests.
+- Verification: 332 portable tests plus 9 optional real owner-contract tests.
 - Informed Decision unsigned adoption draft and native v0.2 orientation runbook;
   no live submission or execution bridge. See docs/decision-runbook-integration.md.
 - Thin pointers installed in four pilot repositories; fresh 0.2.0 pilot evidence
@@ -46,3 +46,12 @@ decisions without widening privilege, and keep root human-controlled.
 - Start with: INTENT.md
 - Agent instructions: AGENTS.md
 - Workplans: workplans/
+
+
+Owner reviews now provide scoped doctrine, vocabulary and PDP-boundary evidence
+for 0.2.1; their institutional/human adoption limits remain explicit. Whitehat
+reported two loaded-package consistency findings, addressed locally in 0.2.2
+with five regression cases. Whitehat review close-out was interrupted by a
+platform cybersecurity-risk block; no clean independent acceptance is claimed.
+Glas model evidence now leaves unreported observed models unknown. Current native
+continuity requirements remain in GLAS-WP-0012; distribution stays a draft.
diff --git a/docs/adoption-review.md b/docs/adoption-review.md
index 089bfc6..12ebf9c 100644
--- a/docs/adoption-review.md
+++ b/docs/adoption-review.md
@@ -34,7 +34,7 @@ requested by this package.
 Actual resume/compaction behavior and governed glas-harness sessions remain
 separate proofs. The reload code is tested, and fresh sessions are exercised;
 neither proves what an actual provider preserves after compaction. Honor the
-blocked/unverified owner profile states. CUST-WP-0073 and GLAS-WP-0008 already
+blocked/unverified owner profile states. CUST-WP-0073 and GLAS-WP-0012 already
 own credential/isolation/readiness concerns; this package does not close them.
 
 The four real-repository read-only pilot reports cover doctrine, access,
@@ -71,3 +71,14 @@ routes withdrawn credential guidance to its source owner/ops-warden and missing
 events to their emitting source owner. The completion audit preserves failed
 full runs, bounded retry passes and unresolved owner/provider/independent gates.
 EMERGENT-WP-0002 is blocked; this review package does not claim adoption.
+
+
+## Owner review and corrected release — 0.2.2
+
+The current unsigned draft binds 0.2.2, digest
+`19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c`.
+`docs/evidence/2026-10-03-owner-reviews-and-022-fixes.md` indexes the owner
+reviews, concrete publication/distribution proposal, Whitehat findings and
+local fixes. Technical reviews retain 0.2.1 pins; they are not human adoption.
+Whitehat close-out and independence acceptance remain incomplete after its
+platform stop. Provider/continuity, pilot and rollout gates remain live.
diff --git a/docs/decision-runbook-integration.md b/docs/decision-runbook-integration.md
index ad1a47a..59ebb01 100644
--- a/docs/decision-runbook-integration.md
+++ b/docs/decision-runbook-integration.md
@@ -52,9 +52,9 @@ Release **0.2.0 (pilot)** adds `decisions` and `runbooks` cards, startup discove
 and revision-pinned owner contracts/code. There are 14 cards, 24 owners and
 69 source files. This is file review, not live capability verification.
 
-The current pilot is **0.2.1**, which clarifies withdrawn-procedure refresh and
+Release **0.2.1**, which clarifies withdrawn-procedure refresh and
 missing-event reconciliation recipients after provider evaluation. The unsigned
-adoption draft binds this corrected release. Exact-release reports and remaining
+adoption draft always binds the current corrected release. Exact-release reports and remaining
 closure gates are indexed in `docs/evidence/2026-10-03-closure-attempt.md`.
 
 - `runbooks/security-orientation/pack.yaml` is a native v0.2 pack owned here. It
@@ -118,3 +118,10 @@ A UI session is not started or exposed by this integration.
 Authoritative references: the pinned `informed-decision` and `runbook-tutorials`
 entries in `knowledge/sources.yaml`; related contracts in
 `docs/operational-contracts.md` and owner map in `docs/netkingdom-integration-map.md`.
+
+
+Current pilot **0.2.2** invalidates loaded knowledge after local release changes
+and serves the exact validated card bytes, addressing Whitehat findings
+WH-KNOW-001/002. Its unsigned draft is freshly rebuilt. The owner-reviewed Glas
+source correction preserves absent observed model metadata as unknown.
+Neither change resolves the existing human adoption or native continuity gates.
diff --git a/docs/decisions/profile-adoption-intake.draft.json b/docs/decisions/profile-adoption-intake.draft.json
index eb180db..835b249 100644
--- a/docs/decisions/profile-adoption-intake.draft.json
+++ b/docs/decisions/profile-adoption-intake.draft.json
@@ -1,7 +1,7 @@
 {
   "kind": "informed-decision.memo-intake",
   "version": 1,
-  "idempotency_key": "emergent-profile-d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767",
+  "idempotency_key": "emergent-profile-19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c",
   "memo_class": "knowledge-profile",
   "review_group": "net-kingdom-admins",
   "drafted_by": "codex@emergent-security (asserted)",
@@ -14,15 +14,15 @@
     "principal": "emergent-security",
     "purpose": "Accept only the non-normative knowledge profile boundary",
     "target": {
-      "id": "emergent-security:knowledge:0.2.1:d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767",
+      "id": "emergent-security:knowledge:0.2.2:19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c",
       "type": "knowledge-profile",
       "system": "emergent-security"
     }
   },
   "memo": {
-    "id": "emergent-profile-adoption-0-2-1",
+    "id": "emergent-profile-adoption-0-2-2",
     "version": 1,
-    "question": "Accept Emergent Security knowledge 0.2.1 as a non-normative NetKingdom agent orientation profile?",
+    "question": "Accept Emergent Security knowledge 0.2.2 as a non-normative NetKingdom agent orientation profile?",
     "requested_act": "approve",
     "binding_level": "organizational",
     "brief": "Accept only the orientation boundary of this exact release; operational authority and remaining review gates stay with their owners.",
@@ -35,7 +35,7 @@
         "identifiers": []
       },
       "target": {
-        "id": "emergent-security:knowledge:0.2.1:d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767",
+        "id": "emergent-security:knowledge:0.2.2:19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c",
         "kind": "knowledge-profile",
         "label": "Non-normative security orientation",
         "environment": "rehearsal",
@@ -49,7 +49,7 @@
       {
         "item_id": "emergent-profile-packet",
         "label": "Profile boundary and limitations",
-        "hash": "sha256:f06b74051ac404dbc82494da4f723939e104787640e7bbdf32c049f609228c0a"
+        "hash": "sha256:3c598ac0754c0fe6d6eab6e5c6910f97f8798adc35eeda4fed22c4ecd0c2f66b"
       }
     ],
     "highlights": [
@@ -76,7 +76,7 @@
     {
       "item_id": "emergent-profile-packet",
       "media_type": "text/markdown",
-      "content": "# Knowledge profile adoption request\n\nAdopt Emergent Security knowledge 0.2.1, release digest d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767, as a\nnon-normative orientation profile for coding agents in NetKingdom.\n\nThe profile points to existing owners, withholds stale guidance, and separates\nhuman decisions, runtime approvals, PDP decisions, credentials and procedure\nrecords. This asks only to accept that orientation boundary. It does not amend\nowner contracts or authorize operational effects, autonomous execution, root,\ncredential changes or fleet rollout.\n\nAlternatives: return for wording/source corrections; decline this profile;\naccept this exact orientation boundary with the documented evidence limits.\nChanging the reviewed package requires a new review, not reuse of this answer.\n\nEvidence: knowledge/sources.yaml; docs/decision-runbook-integration.md;\ndocs/operational-contracts.md; docs/adoption-review.md; docs/evidence/.\nEarlier provider reports concern release 0.1.1. New integration evidence is\nseparately scoped; no independent review or full Grok validation is claimed.\nActual compaction/harness proof and wider adoption remain open in EMERGENT-WP-0002.\n\nThe draft is unsubmitted. The proposed memo class and review group must be\nconfirmed by the owner; a synthetic test grant proves format only. INFD-WP-0005\nintake rollout remains unfinished. This draft resolves no Statehub decision.\n"
+      "content": "# Knowledge profile adoption request\n\nAdopt Emergent Security knowledge 0.2.2, release digest 19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c, as a\nnon-normative orientation profile for coding agents in NetKingdom.\n\nThe profile points to existing owners, withholds stale guidance, and separates\nhuman decisions, runtime approvals, PDP decisions, credentials and procedure\nrecords. This asks only to accept that orientation boundary. It does not amend\nowner contracts or authorize operational effects, autonomous execution, root,\ncredential changes or fleet rollout.\n\nAlternatives: return for wording/source corrections; decline this profile;\naccept this exact orientation boundary with the documented evidence limits.\nChanging the reviewed package requires a new review, not reuse of this answer.\n\nEvidence: knowledge/sources.yaml; docs/decision-runbook-integration.md;\ndocs/operational-contracts.md; docs/adoption-review.md; docs/evidence/.\nEarlier provider reports and owner reviews retain their original release pins.\nWhitehat's separately authored offline 0.2.1 review found loaded-package binding\nand lifecycle gaps; 0.2.2 addresses them with local regressions. Review close-out\nand clean independent acceptance remain incomplete. No full Grok validation is claimed.\nActual compaction/harness proof and wider adoption remain open in EMERGENT-WP-0002.\n\nThe draft is unsubmitted. The proposed memo class and review group must be\nconfirmed by the owner; a synthetic test grant proves format only. INFD-WP-0005\nintake rollout remains unfinished. This draft resolves no Statehub decision.\n"
     }
   ]
 }
diff --git a/docs/evidence/2026-10-03-022-package-check.json b/docs/evidence/2026-10-03-022-package-check.json
new file mode 100644
index 0000000..14463e6
--- /dev/null
+++ b/docs/evidence/2026-10-03-022-package-check.json
@@ -0,0 +1,33 @@
+{
+  "schema": "emergent.knowledge-check.v1",
+  "version": "0.2.2",
+  "package_digest": "19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c",
+  "sources": {
+    "net-kingdom": "verified-files",
+    "gate-house": "verified-files",
+    "ops-warden": "verified-files",
+    "ops-mason": "verified-files",
+    "access-engine": "verified-files",
+    "security-canon": "verified-files",
+    "user-engine": "verified-files",
+    "tenant-engine": "verified-files",
+    "zone-engine": "verified-files",
+    "whitehat-security": "verified-files",
+    "kings-guard": "verified-files",
+    "secrets-engine": "verified-files",
+    "key-cape": "verified-files",
+    "approval-engine": "verified-files",
+    "informed-decision": "verified-files",
+    "audit-core": "verified-files",
+    "risk-nexus": "verified-files",
+    "info-tech-canon": "verified-files",
+    "ops-bridge": "verified-files",
+    "railiance-master": "verified-files",
+    "glas-harness": "verified-files",
+    "the-custodian": "verified-files",
+    "emergent-security": "verified-files",
+    "runbook-tutorials": "verified-files"
+  },
+  "live_state_verified": false,
+  "ok": true
+}
diff --git a/docs/evidence/2026-10-03-owner-reviews-and-022-fixes.md b/docs/evidence/2026-10-03-owner-reviews-and-022-fixes.md
new file mode 100644
index 0000000..8ca6209
--- /dev/null
+++ b/docs/evidence/2026-10-03-owner-reviews-and-022-fixes.md
@@ -0,0 +1,93 @@
+# Owner reviews and loaded-package consistency fixes — 2026-10-03
+
+Current pilot: **0.2.2**, manifest digest
+`19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c`.
+All 24 inventoried source owners verify as files; startup remains 5,091 bytes.
+File checks do not prove deployment, permission, provider readiness or adoption.
+
+## Separately scoped owner evidence
+
+| Owner | Review artifact / live record | Observed disposition |
+| --- | --- | --- |
+| gate-house | `docs/conformance/2026-10-03-emergent-knowledge-021-review.md`; GH-WP-ADHOC-2026-10-03-T02; pushed `755c36ae19c3789365d8f6405158730365da3572` | No blocking doctrine conflict in the non-normative profile; human adoption/publication remain open |
+| net-kingdom | `docs/evidence/2026-10-03-emergent-knowledge-021-review.md`; NK-WP-ADHOC-2026-10-03-T01; pushed `9e3ad860d61e0b6a3a23d9c1a54235e1d73d3b76` | Accurate owner boundaries; documentary feedback on retained pilot; publication pointer proposed after gates |
+| security-canon | `docs/emergent-knowledge-021-review.md`; SECURITY-WP-ADHOC-2026-10-03-T01; pushed `5a67d60184025cc0292b714f5da43ef5f0b6a588` | No blocking mode/scope vocabulary conflict; optional principal-type source clarification remains SECURITY-IN-0001 |
+| access-engine (flex-auth) | `docs/evidence/2026-10-03-emergent-profile-boundary-review.md`; pushed `d7f85a7dde28a120a635b748aa64805a2f7fdf84` | Scoped technical acceptance of orientation/PDP distinction, binding/approval/fact boundaries; no live authorization |
+| glas-harness | `docs/evidence/2026-10-03-emergent-session-readiness-review.md`; GLAS-WP-0012-T04; pushed `5ce4f38aedfd27cc783131f18480df02e2951514` | Native continuity is not currently supplied by the lifecycle contract; configured model pins cannot substitute for observed model metadata |
+| the-custodian | `docs/emergent-knowledge-distribution-draft.md`; CUST-WP-0073-T04; pushed `c4558d4d10b58946c1534c7f5ccaef5ab6210890` | Concrete distribution/maintenance proposal, unaccepted and unpublished; native identity/readiness gates remain |
+| whitehat-security | `evidence/2026-10-03-emergent-021-offline-review.md` and `.json`; WHITEHAT-WP-0009 | Nine separately authored offline probes: seven bounded passes, two findings; review close-out interrupted |
+
+Paths above are relative to their owner repository. Reviews retain original
+0.2.1 digest/commit and independence limits. They are agent-authored technical
+reviews, not authenticated human decisions or institutional assent. Renewed
+exact-release evidence is required after changed source/runtime artifacts.
+Gate House/NetKingdom/SecurityCanon worker reported primary reconciliation with
+matching pushed and derived commits; runtime owner sync receipts are tracked by
+that worker. No pending publication proposal is treated as accepted doctrine.
+
+Proposed ownership division is now concrete: Emergent maintains/seals the bundle;
+NetKingdom publishes the estate profile pointer; Gate House owns teaching;
+SecurityCanon owns imported vocabulary; Glas owns native session delivery and
+proof; the Custodian coordinates reach after accepted rollout gates. The
+existing adoption decision remains `d20a9750-2b29-534e-8227-fb866581a6ca`.
+
+## Whitehat findings and local remediation
+
+WH-KNOW-001: modifying a card after `Knowledge()` construction previously
+returned unsealed bytes under the original receipt digest. WH-KNOW-002: an
+already loaded source lifecycle remained active after withdrawal/reseal while
+fresh construction correctly withheld it. Both are copied-bundle library
+consistency findings; neither establishes runtime permission bypass or a live
+attack. Detailed prerequisites and limits remain in Whitehat's original report.
+
+The five regression cases were introduced before the implementation fix and
+failed against the previous runtime: post-load card mutation; resealed withdrawal
+on retrieval, check and public source-status; and changing a card after its byte
+read to test that returned content is exactly the validated content.
+
+The runtime now reads/parses metadata from the same sealed byte snapshot,
+revalidates the original release digest and all package files on each public
+retrieval/check/source-status operation, detects a changed seal before and after
+bundle reads, and requires explicit reload of a newly reviewed bundle. Returned
+cards decode the exact bytes just hashed, with no second content-file read.
+An unsealed file update fails closed. Offline bundles cannot discover owner
+withdrawals that have not been delivered; documented freshness limits remain.
+
+Local verification: **341 tests pass**, including nine real owner-contract tests;
+focused knowledge suite **38 pass**. Seal, exact-release adoption-draft freshness,
+and all 24 source-file checks pass. Wheel and source archive build; unpacked
+wheel retrieval loads the corrected runtime and 0.2.2 seal, returning the expected
+offline snapshot and startup size. The draft packet was rebuilt and owner-format
+checks rerun after its explanatory text changed. None is independent retest or
+institutional acceptance of remediation.
+
+## Source-change handling and evidence limits
+
+Glas fixed configured-pin fallback in its gateway/adapters and documented that
+only a rein/provider report supplies `resolved_model`; missing observations stay
+null, and an alias is not an exact revision or conversation ID. Its worker reports
+139 deterministic tests pass. The append to inventoried harness-contract.md
+caused our old source check to return `changed`, as intended. After inspecting
+the appendix and matching all three inventoried files against the actual owner
+commit, we re-pinned Glas to the pushed revision above and resealed 0.2.2.
+No other owner source was silently refreshed. GLAS-WP-0008 is finished;
+GLAS-WP-0012 owns remaining acceptance rather than the completed historical plan.
+
+Whitehat's separate review of retained provider answers accepts Codex 28/28;
+Claude is **26/28** under its recipient rubric (zones routes to PDP instead of
+capability owner; model-switch routes to package publisher). The implementing
+session's earlier 27/28 report stays unchanged; neither is relabeled as 0.2.2.
+No unsafe effect recommendation was observed in those retained answers.
+
+The platform's cybersecurity-risk review stopped the Whitehat worker after its
+findings/reproductions were saved and delivered. WHITEHAT-WP-0009-T03 close-out,
+owner sync and any clean independent acceptance remain incomplete. The saved
+report clearly says the reviewer shares parent session/model/workspace and is
+not a separately authenticated Whitehat principal. This work does not bypass
+that stop or label root-authored regressions as independent validation.
+
+Remaining required work stays live in EMERGENT-WP-0002 T02/T05/T07/T08/T09/T10,
+WHITEHAT-WP-0009-T03, GLAS-WP-0012 and CUST-WP-0073. Provider evaluation and
+pilot/admission owner feedback continue in their assigned repository workers.
+No DoD-Ok, submitted adoption, fleet notice, credential operation, blocked
+profile activation or live production change is claimed.
diff --git a/docs/knowledge-maintenance.md b/docs/knowledge-maintenance.md
index ba0d606..3c83f63 100644
--- a/docs/knowledge-maintenance.md
+++ b/docs/knowledge-maintenance.md
@@ -66,6 +66,13 @@ current owner's authorization path.
 
 ## Refresh ownership
 
+From 0.2.2, each retrieval, check and public source-status call revalidates the
+loaded release seal and package files. Returned cards use the exact bytes
+validated against that seal. A changed seal invalidates the loaded object:
+explicitly reload the reviewed bundle rather than silently following an update.
+Unsealed file changes fail closed. This detects local bundle changes; an offline
+bundle still cannot discover an upstream withdrawal it has not received.
+
 Emergent Security maintains the package and tests. Every source remains owned
 by its repository; gate-house/net-kingdom adoption and publication review are
 tracked in EMERGENT-WP-0002-T02/T09, not presumed accepted. Review at least every
diff --git a/docs/netkingdom-integration-map.md b/docs/netkingdom-integration-map.md
index a82ce6f..b92935a 100644
--- a/docs/netkingdom-integration-map.md
+++ b/docs/netkingdom-integration-map.md
@@ -26,7 +26,7 @@ All references are pinned; `knowledge/sources.yaml` also records file hashes and
 | info-tech-canon | shared-semantics | [README.md](https://forgejo.coulomb.social/coulomb/info-tech-canon/src/commit/b30c831b387b11b41b2a4206e516fac65b84c29f/README.md) |
 | ops-bridge | transport | [README.txt](https://forgejo.coulomb.social/coulomb/ops-bridge/src/commit/190ef1e188e12c606f1359325fd9fdd1dbef29e2/README.txt); [INTENT.md](https://forgejo.coulomb.social/coulomb/ops-bridge/src/commit/190ef1e188e12c606f1359325fd9fdd1dbef29e2/INTENT.md) |
 | railiance-master | workload-operations | [README.md](https://forgejo.coulomb.social/coulomb/railiance-master/src/commit/a61b31396f0936ddd302b27a5222046240e413b2/README.md); [INTENT.md](https://forgejo.coulomb.social/coulomb/railiance-master/src/commit/a61b31396f0936ddd302b27a5222046240e413b2/INTENT.md) |
-| glas-harness | session-execution | [README.md](https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/dc49415c9f7c62a4d16e29e0ffa7be00eb002c28/README.md); [docs/harness-contract.md](https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/dc49415c9f7c62a4d16e29e0ffa7be00eb002c28/docs/harness-contract.md); [docs/execution-profiles.md](https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/dc49415c9f7c62a4d16e29e0ffa7be00eb002c28/docs/execution-profiles.md) |
+| glas-harness | session-execution | [README.md](https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/5ce4f38aedfd27cc783131f18480df02e2951514/README.md); [docs/harness-contract.md](https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/5ce4f38aedfd27cc783131f18480df02e2951514/docs/harness-contract.md); [docs/execution-profiles.md](https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/5ce4f38aedfd27cc783131f18480df02e2951514/docs/execution-profiles.md) |
 | the-custodian | estate-orientation | [docs/agent-environment-orientation.md](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/f303bdaff1a7f3f2305a375a3b5870cb0262e70c/docs/agent-environment-orientation.md); [docs/agent-autonomy-decision.md](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/f303bdaff1a7f3f2305a375a3b5870cb0262e70c/docs/agent-autonomy-decision.md); [docs/security-close-down-checklist.md](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/f303bdaff1a7f3f2305a375a3b5870cb0262e70c/docs/security-close-down-checklist.md) |
 | emergent-security | offline-reference | [specs/emergent-security-0.8.md](https://forgejo.coulomb.social/coulomb/emergent-security/src/commit/caa7da2397ff860dba4de2824da998ed8c045ef2/specs/emergent-security-0.8.md); [envelopes/default-envelope.yaml](https://forgejo.coulomb.social/coulomb/emergent-security/src/commit/caa7da2397ff860dba4de2824da998ed8c045ef2/envelopes/default-envelope.yaml) |
 
@@ -38,7 +38,7 @@ All references are pinned; `knowledge/sources.yaml` also records file hashes and
 - tenant-engine SCOPE contains old gaps beside newer shipped entries. TEN-WP-0012 tracks outstanding external custody/canon dependencies; treat runtime readiness separately.
 - access-engine decision-record documentation contains old unsigned-channel prose beside newer signature fields; actual consumer authentication/enforcement requires current owner proof.
 - the-custodian CUST-WP-0073 tracks agent credential separation. Loading this knowledge does not close that work.
-- glas-harness GLAS-WP-0008 separates operational readiness from profile selection; blocked/unverified profiles remain so.
+- glas-harness GLAS-WP-0008 is finished: operational readiness is separate from profile selection. GLAS-WP-0012 owns remaining runtime/provider acceptance and continuity proof; blocked/unverified profiles remain so.
 - gate-house GH-WP-0004 holds layer-declaration work. This repo declares its own boundary; it does not declare conformance on behalf of another owner.
 - OpenBao is referenced through secrets-engine and the net-kingdom infrastructure boundary; it is not a new repository or credential route owned here.
 
diff --git a/knowledge/catalog.yaml b/knowledge/catalog.yaml
index 8ca4f8b..9fcf11f 100644
--- a/knowledge/catalog.yaml
+++ b/knowledge/catalog.yaml
@@ -1,5 +1,5 @@
 schema: emergent.knowledge.v1
-version: 0.2.1
+version: 0.2.2
 status: pilot
 startup_max_bytes: 5500
 cards:
diff --git a/knowledge/release.yaml b/knowledge/release.yaml
index 76e0a1b..959146c 100644
--- a/knowledge/release.yaml
+++ b/knowledge/release.yaml
@@ -1,9 +1,9 @@
 schema: emergent.release.v1
-version: 0.2.1
+version: 0.2.2
 trust: repository-reviewed-content; hashes are not signatures
 files:
-  catalog.yaml: 497c0b40cd5519157ae684e4e501ae77cab1b2710a13f559dd85cd62dffd04cd
-  sources.yaml: 831d552d4aac9d73cd086b5fc29b2bbadb1751a1d1bab36fea2c9598adb678a4
+  catalog.yaml: 29e0a87b4bbab09b5c040a904ebc918c3c370760cdaf890a3e3cb610f141cb82
+  sources.yaml: 0f2063dda5aee344f073a4ae354dacce1bfbe01d440805f6f8908f86c2d75525
   cards/access.md: 53fb77027593caa45308388b4c6e95c632c759c8014bc5cc52cb249df9c312f3
   cards/compatibility.md: bf78349d59b2e5773706bc5d87853039626d8a2ae784b5f2ae10108b2b9ca3f6
   cards/construction.md: 9b2a770a857d5c258e0175119e39a6251b133b86346bb0384827e276dbff3732
diff --git a/knowledge/sources.yaml b/knowledge/sources.yaml
index 03463c4..8f11848 100644
--- a/knowledge/sources.yaml
+++ b/knowledge/sources.yaml
@@ -515,7 +515,7 @@ sources:
 - id: glas-harness
   owner: glas-harness
   repository: glas-harness
-  revision: dc49415c9f7c62a4d16e29e0ffa7be00eb002c28
+  revision: 5ce4f38aedfd27cc783131f18480df02e2951514
   layer: unclassified-here
   role: session-execution
   authority_type: owner-documentation
@@ -530,15 +530,15 @@ sources:
   - path: README.md
     sha256: 23179d6a1760e442fa025ac73aed050ee0141e985e87979c0a05781fdc2ca350
     matches_commit: true
-    url: https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/dc49415c9f7c62a4d16e29e0ffa7be00eb002c28/README.md
+    url: https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/5ce4f38aedfd27cc783131f18480df02e2951514/README.md
   - path: docs/harness-contract.md
-    sha256: 5bd559d645a0fb9813dc12e4cc10f6aaa444ab4843921c541ad460645d56fdee
+    sha256: 96e274ea547844e5062eab96c05231bc4d9ffb81306f1e9c5e3cc1ee2c8c87f9
     matches_commit: true
-    url: https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/dc49415c9f7c62a4d16e29e0ffa7be00eb002c28/docs/harness-contract.md
+    url: https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/5ce4f38aedfd27cc783131f18480df02e2951514/docs/harness-contract.md
   - path: docs/execution-profiles.md
     sha256: 85e9c82bd5f9161a17b4a701bf9dad9e8772bff96e44b525767ad1f84c76bc35
     matches_commit: true
-    url: https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/dc49415c9f7c62a4d16e29e0ffa7be00eb002c28/docs/execution-profiles.md
+    url: https://forgejo.coulomb.social/coulomb/glas-harness/src/commit/5ce4f38aedfd27cc783131f18480df02e2951514/docs/execution-profiles.md
 - id: the-custodian
   owner: the-custodian
   repository: the-custodian
diff --git a/src/emergent_security/knowledge.py b/src/emergent_security/knowledge.py
index 4e0e5d4..c26d764 100644
--- a/src/emergent_security/knowledge.py
+++ b/src/emergent_security/knowledge.py
@@ -40,16 +40,27 @@ def _mapping(loader, node, deep=False):
 UniqueLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, _mapping)
 
 
-def read_yaml(path: Path) -> dict:
+def _read_bytes(path: Path) -> bytes:
     try:
-        value = yaml.load(path.read_text(encoding="utf-8"), Loader=UniqueLoader)
-    except (OSError, UnicodeError, yaml.YAMLError):
+        return path.read_bytes()
+    except OSError:
+        raise KnowledgeError("unreadable content") from None
+
+
+def _yaml_mapping(data: bytes) -> dict:
+    try:
+        value = yaml.load(data.decode("utf-8"), Loader=UniqueLoader)
+    except (UnicodeError, yaml.YAMLError):
         raise KnowledgeError("unreadable YAML document") from None
     if not isinstance(value, dict):
         raise KnowledgeError("expected YAML mapping")
     return value
 
 
+def read_yaml(path: Path) -> dict:
+    return _yaml_mapping(_read_bytes(path))
+
+
 def confined(root: Path, name: str) -> Path:
     if not isinstance(name, str) or not name or Path(name).is_absolute() or ".." in Path(name).parts:
         raise KnowledgeError("invalid relative path")
@@ -90,19 +101,20 @@ def default_bundle() -> Path:
 class Knowledge:
     def __init__(self, root: Path | None = None):
         self.root = (root or default_bundle()).resolve()
-        self.release = read_yaml(confined(self.root, "release.yaml"))
+        release_bytes = _read_bytes(confined(self.root, "release.yaml"))
+        self.package_digest = hashlib.sha256(release_bytes).hexdigest()
+        self.release = _yaml_mapping(release_bytes)
         if self.release.get("schema") != "emergent.release.v1":
             raise KnowledgeError("unsupported release schema")
         hashes = self.release.get("files")
         if not isinstance(hashes, dict) or not {"catalog.yaml", "sources.yaml"} <= hashes.keys():
             raise KnowledgeError("incomplete release manifest")
-        for name, expected in hashes.items():
+        for expected in hashes.values():
             if not isinstance(expected, str) or not re.fullmatch(r"[a-f0-9]{64}", expected):
                 raise KnowledgeError("invalid release digest")
-            if digest(confined(self.root, name)) != expected:
-                raise KnowledgeError("release content changed; review and reseal")
-        self.catalog = read_yaml(confined(self.root, "catalog.yaml"))
-        sources = read_yaml(confined(self.root, "sources.yaml"))
+        contents = self._verified_contents()
+        self.catalog = _yaml_mapping(contents["catalog.yaml"])
+        sources = _yaml_mapping(contents["sources.yaml"])
         if self.catalog.get("schema") != "emergent.knowledge.v1" or sources.get("schema") != "emergent.sources.v1":
             raise KnowledgeError("unsupported knowledge schema")
         if self.catalog.get("version") != self.release.get("version"):
@@ -146,9 +158,31 @@ class Knowledge:
                     raise KnowledgeError("invalid source digest")
                 if not str(document.get("url", "")).startswith("https://forgejo.coulomb.social/"):
                     raise KnowledgeError("invalid canonical source URL")
-        self.package_digest = digest(self.root / "release.yaml")
+
+    def _verified_contents(self) -> dict[str, bytes]:
+        """Bind every operation to this load's seal and return verified bytes.
+
+        A changed seal requires an explicit reload, never silent adoption. Read
+        each file once so the bytes served cannot differ from the bytes hashed.
+        """
+        release_path = confined(self.root, "release.yaml")
+        if digest(release_path) != self.package_digest:
+            raise KnowledgeError("release changed; reload the reviewed bundle")
+        contents = {}
+        for name, expected in self.release["files"].items():
+            data = _read_bytes(confined(self.root, name))
+            if hashlib.sha256(data).hexdigest() != expected:
+                raise KnowledgeError("release content changed; review and reseal")
+            contents[name] = data
+        if digest(confined(self.root, "release.yaml")) != self.package_digest:
+            raise KnowledgeError("release changed; reload the reviewed bundle")
+        return contents
 
     def source_status(self, ref: str, repositories: Path | None, today: date) -> str:
+        self._verified_contents()
+        return self._source_status(ref, repositories, today)
+
+    def _source_status(self, ref: str, repositories: Path | None, today: date) -> str:
         source = self.sources[ref]
         if source["status"] != "active":
             return source["status"]
@@ -174,6 +208,7 @@ class Knowledge:
 
     def retrieve(self, card_id: str, *, audience: str = "local",
                  repositories: Path | None = None, today: date | None = None) -> dict:
+        contents = self._verified_contents()
         if card_id not in self.cards:
             raise KnowledgeError("unknown card; use list")
         card = self.cards[card_id]
@@ -182,7 +217,7 @@ class Knowledge:
             raise KnowledgeError("private or tenant content is not served")
         if audience not in card.get("audiences", []):
             raise KnowledgeError("audience not approved for this card")
-        statuses = {ref: self.source_status(ref, repositories, today or date.today())
+        statuses = {ref: self._source_status(ref, repositories, today or date.today())
                     for ref in card["sources"]}
         withdrawn = any(value in {"withdrawn", "superseded"} for value in statuses.values())
         stale = any(value in {"changed", "review-due", "future-verification"} for value in statuses.values())
@@ -190,7 +225,10 @@ class Knowledge:
         # dated snapshot useful for orientation, with no current-authority claim.
         state = "withheld" if withdrawn or stale else (
             "verified-files" if all(v == "verified-files" for v in statuses.values()) else "offline-snapshot")
-        text = "" if state == "withheld" else confined(self.root, card["path"]).read_text(encoding="utf-8")
+        try:
+            text = "" if state == "withheld" else contents[card["path"]].decode("utf-8")
+        except UnicodeError:
+            raise KnowledgeError("unreadable card") from None
         if card_id == "start" and len(text.encode()) > self.catalog["startup_max_bytes"]:
             raise KnowledgeError("startup context budget exceeded")
         return {
@@ -207,7 +245,8 @@ class Knowledge:
         }
 
     def check(self, repositories: Path | None = None, today: date | None = None) -> dict:
-        statuses = {ref: self.source_status(ref, repositories, today or date.today()) for ref in self.sources}
+        self._verified_contents()
+        statuses = {ref: self._source_status(ref, repositories, today or date.today()) for ref in self.sources}
         return {"schema": "emergent.knowledge-check.v1", "version": self.catalog["version"],
                 "package_digest": self.package_digest, "sources": statuses,
                 "live_state_verified": False,
diff --git a/tests/test_knowledge.py b/tests/test_knowledge.py
index 69e4a6c..bf26429 100644
--- a/tests/test_knowledge.py
+++ b/tests/test_knowledge.py
@@ -225,6 +225,48 @@ def test_resume_reload_rechecks_sources_instead_of_reusing_a_verdict(bundle):
     assert first["package_digest"] != second["package_digest"]
 
 
+def test_loaded_package_refuses_card_changed_after_validation(bundle):
+    package = Knowledge(bundle)
+    (bundle / "cards/start.md").write_text("unsealed injected guidance")
+    with pytest.raises(KnowledgeError, match="content changed"):
+        package.retrieve("start", today=TODAY)
+
+
+@pytest.mark.parametrize("operation", ["retrieve", "check", "source_status"])
+def test_loaded_package_requires_reload_after_resealed_withdrawal(bundle, operation):
+    package = Knowledge(bundle)
+    edit_source(bundle, status="withdrawn")
+    with pytest.raises(KnowledgeError, match="reload"):
+        if operation == "retrieve":
+            package.retrieve("start", today=TODAY)
+        elif operation == "check":
+            package.check(today=TODAY)
+        else:
+            package.source_status("net-kingdom", None, TODAY)
+    assert Knowledge(bundle).retrieve("start", today=TODAY)["status"] == "withheld"
+
+
+def test_returned_card_uses_the_same_bytes_that_were_verified(bundle, monkeypatch):
+    package = Knowledge(bundle)
+    path = bundle / "cards/start.md"
+    original = path.read_text()
+    read_bytes = Path.read_bytes
+    verified_reads = []
+
+    def replace_after_read(candidate):
+        data = read_bytes(candidate)
+        if candidate == path:
+            verified_reads.append(candidate)
+            path.write_text("injected after hash verification")
+        return data
+
+    monkeypatch.setattr(Path, "read_bytes", replace_after_read)
+    result = package.retrieve("start", today=TODAY)
+    assert len(verified_reads) == 1
+    assert result["content"] == original
+    assert result["package_digest"] == package.package_digest
+
+
 @pytest.mark.parametrize('owner,card', [('informed-decision', 'decisions'), ('runbook-tutorials', 'runbooks')])
 def test_withdrawn_handoff_owner_withholds_journey_and_startup(bundle, owner, card):
     sources = read_yaml(bundle / 'sources.yaml')
diff --git a/tools/build_adoption_draft.py b/tools/build_adoption_draft.py
index 6b24782..d994c53 100644
--- a/tools/build_adoption_draft.py
+++ b/tools/build_adoption_draft.py
@@ -37,8 +37,10 @@ Changing the reviewed package requires a new review, not reuse of this answer.
 
 Evidence: knowledge/sources.yaml; docs/decision-runbook-integration.md;
 docs/operational-contracts.md; docs/adoption-review.md; docs/evidence/.
-Earlier provider reports concern release 0.1.1. New integration evidence is
-separately scoped; no independent review or full Grok validation is claimed.
+Earlier provider reports and owner reviews retain their original release pins.
+Whitehat's separately authored offline 0.2.1 review found loaded-package binding
+and lifecycle gaps; 0.2.2 addresses them with local regressions. Review close-out
+and clean independent acceptance remain incomplete. No full Grok validation is claimed.
 Actual compaction/harness proof and wider adoption remain open in EMERGENT-WP-0002.
 
 The draft is unsubmitted. The proposed memo class and review group must be
diff --git a/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md b/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md
index 6bf2482..5d44f28 100644
--- a/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md
+++ b/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md
@@ -499,3 +499,46 @@ fleet notice or human decision is authorized by this engagement. Scope remains
 release 0.2.1 and its recorded digest; the plan returns to **active** while the
 workers pursue the pending gates. T08/T10 remain waiting. The closure attempt
 above is a historical checkpoint; no DoD-Ok is claimed by starting workers.
+
+
+## Owner findings and consistency remediation — 2026-10-03
+
+The owner workers delivered scoped doctrine, vocabulary, PDP-boundary and
+session/distribution reviews. Gate House, NetKingdom and SecurityCanon found no
+blocking documentary conflict; Access Engine technically accepts the orientation
+boundary. Their original 0.2.1 pins, human/institutional limits and 0.2.2 renewal
+conditions are retained. Publication and teaching roles have a concrete proposal,
+not a human adoption or published fleet notice. Owner evidence/work-record IDs:
+`docs/evidence/2026-10-03-owner-reviews-and-022-fixes.md`.
+
+Whitehat's WHITEHAT-WP-0009 delivered WH-KNOW-001/002: post-load unsealed card
+bytes and unobserved source withdrawal after reseal. **T04 was reopened for
+remediation** within this existing plan. Five failing regressions reproduce the
+binding/lifecycle gaps. Local implementation now revalidates the seal/package on
+each operation, requires explicit reload after release changes, and returns the
+exact hashed card bytes. **T04 implementation is done again:** 341 tests pass,
+including nine real owner-contract checks; focused knowledge suite 38 passes.
+Clean independent remediation acceptance remains part of T07, not inferred from
+these implementing tests.
+
+Corrected pilot **0.2.2**, digest
+`19de26540c693b94ac8c19d7ed2ddd901acbc828c9b8a78b44c1a43ca468222c`.
+The Glas owner fixed configured-model fallback and appended its contract. Our
+source check detected that change, then the reviewed actual committed files were
+re-pinned to `5ce4f38aedfd27cc783131f18480df02e2951514` before resealing. All
+24 source owners verify as files. GLAS-WP-0008 is finished; GLAS-WP-0012 now holds
+native provider/readiness/continuity evidence. CUST-WP-0073 holds distribution
+and identity requirements. The unsigned adoption packet binds this exact release
+and remains unsubmitted.
+
+Whitehat's separate retained-Claude rubric scores 26/28 (zones capability-owner
+routing plus model-switch recipient), compared with the earlier implementing
+27/28; preserve both reviews and their limits. The Whitehat worker was stopped
+by the platform cybersecurity-risk review after saving and delivering findings.
+Its T03 close-out/sync and independence acceptance remain incomplete; do not
+restart around the block or claim root regression tests close that review.
+
+Workers continue provider diagnosis/current-release evidence, pilot feedback in
+ops-warden/tenant-engine/railiance-master, and Informed Decision's actual attended
+submission/admission requirements. Required gaps remain live in the original
+T02/T05/T07/T08/T09/T10; no workplan completion or runtime authority is asserted.