Bind knowledge retrieval to sealed bytes and invalidate changed releases

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10238-7ecc-78e2-903d-075f50e913cc

docs/decision-runbook-integration.md

@@ -52,9 +52,9 @@ Release **0.2.0 (pilot)** adds `decisions` and `runbooks` cards, startup discove
 and revision-pinned owner contracts/code. There are 14 cards, 24 owners and
 69 source files. This is file review, not live capability verification.
 
-The current pilot is **0.2.1**, which clarifies withdrawn-procedure refresh and
+Release **0.2.1**, which clarifies withdrawn-procedure refresh and
 missing-event reconciliation recipients after provider evaluation. The unsigned
-adoption draft binds this corrected release. Exact-release reports and remaining
+adoption draft always binds the current corrected release. Exact-release reports and remaining
 closure gates are indexed in `docs/evidence/2026-10-03-closure-attempt.md`.
 
 - `runbooks/security-orientation/pack.yaml` is a native v0.2 pack owned here. It
@@ -118,3 +118,10 @@ A UI session is not started or exposed by this integration.
 Authoritative references: the pinned `informed-decision` and `runbook-tutorials`
 entries in `knowledge/sources.yaml`; related contracts in
 `docs/operational-contracts.md` and owner map in `docs/netkingdom-integration-map.md`.
+
+
+Current pilot **0.2.2** invalidates loaded knowledge after local release changes
+and serves the exact validated card bytes, addressing Whitehat findings
+WH-KNOW-001/002. Its unsigned draft is freshly rebuilt. The owner-reviewed Glas
+source correction preserves absent observed model metadata as unknown.
+Neither change resolves the existing human adoption or native continuity gates.