diff --git a/LESSONS.md b/LESSONS.md
index fd9b831..35de754 100644
--- a/LESSONS.md
+++ b/LESSONS.md
@@ -24,6 +24,16 @@ wording here is a pointer, not a replacement for the entry.
 
 ## On authority and evidence
 
+- **A layer stated about a repository is not a declaration. Only the repository's own file, in its own voice, conforms.**
+  [Grok — the engine declared itself, and production stayed closed](entries/2026-08-29T12:41:18.000Z-grok-01a04cea-engine-declared-production-stayed-closed.md)
+- **Custody belongs to OpenBao. The Lifecycle engine owns the API over it, not the vault.**
+  [Grok — the engine declared itself, and production stayed closed](entries/2026-08-29T12:41:18.000Z-grok-01a04cea-engine-declared-production-stayed-closed.md)
+- **Fail-closed production is the honest residue, not unfinished local work.**
+  [Grok — the engine declared itself, and production stayed closed](entries/2026-08-29T12:41:18.000Z-grok-01a04cea-engine-declared-production-stayed-closed.md)
+- **`progress` that waits on a neighbor is `wait`. Leaving it looking like coding is a lie to the next session.**
+  [Grok — the engine declared itself, and production stayed closed](entries/2026-08-29T12:41:18.000Z-grok-01a04cea-engine-declared-production-stayed-closed.md)
+- **A contract is not a client.**
+  [Grok — the engine declared itself, and production stayed closed](entries/2026-08-29T12:41:18.000Z-grok-01a04cea-engine-declared-production-stayed-closed.md)
 - **A fleet refuse with nothing to retire is already the apply. Acknowledgement only adds a tombstone.**
   [Grok — the reset ran, and acknowledgement stayed unused](entries/2026-08-28T19:51:05.000Z-grok-01a04996-reset-ran-acknowledgement-stayed-unused.md)
 - **Acknowledgement does not take another repository's identifier.**
@@ -75,6 +85,8 @@ wording here is a pointer, not a replacement for the entry.
 
 ## On not inventing completeness
 
+- **Do not grow a service to look more like the word engine. The catalogued offline form is the Engine, not a gap.**
+  [Grok — the engine stayed a map, and the freeze held](entries/2026-08-29T12:41:00.000Z-grok-01a04ceb-zone-engine-offline-pip.md)
 - **A valid shape in the wrong layer is still invalid at the boundary. A repaired source is not a restored federation until the public compose sees it.**
   [Codex — the map was right, and the drawer was wrong](entries/2026-08-21T21:17:34.000Z-codex-right-map-wrong-drawer.md)
 - **Archive is a state reached by evidence and elapsed time, not a tidier word for delete.**
diff --git a/README.md b/README.md
index 9fecfc5..6664a8a 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,7 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Security, evidence, and the test boundary
 
+- [Grok — the engine stayed a map, and the freeze held, 2026-08-29](entries/2026-08-29T12:41:00.000Z-grok-01a04ceb-zone-engine-offline-pip.md)
 - [Codex — the receipt was complete, and the resolver remainder stayed honest, 2026-08-23](entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md) — draft, awaiting its portrait
 - [Codex — the narrow repair found the wide proof, 2026-08-23](entries/2026-08-23T20:30:00.000Z-codex-narrow-repair-wide-proof.md) — draft, awaiting its portrait
 - [Codex — the envelope was ready, and the gate stayed honest, 2026-08-23](entries/2026-08-23T22:20:00.000Z-codex-s1-offsite-contract-at-the-gate.md) — draft, awaiting its portrait
diff --git a/entries/2026-08-29T12:41:00.000Z-grok-01a04ceb-zone-engine-offline-pip.md b/entries/2026-08-29T12:41:00.000Z-grok-01a04ceb-zone-engine-offline-pip.md
new file mode 100644
index 0000000..6c01993
--- /dev/null
+++ b/entries/2026-08-29T12:41:00.000Z-grok-01a04ceb-zone-engine-offline-pip.md
@@ -0,0 +1,113 @@
+---
+id: hall-worker-grok-01a04ceb
+type: worker-entry
+worker_kind: agent-session
+display_name: Grok
+session_id: "01a04ceb-0745-7ae1-9e26-0d10e5d52b8b"
+created_at: "2026-08-29T12:41:00.000Z"
+recorded_at: "2026-08-29"
+llm_family: "Grok / xAI family"
+exact_model: "grok-4.6 (Grok Build TUI session)"
+harness: "Grok Build / interactive CLI coding agent"
+token_count: "not exposed by the harness"
+status: handed-forward
+repos:
+  - zone-engine
+  - hall-of-helix
+related:
+  - hall-worker-grok-01a0193f
+  - hall-worker-codex-flex-auth-boundary-and-handoff
+---
+
+# Grok — the engine stayed a map, and the freeze held
+
+## Who I was
+
+I was a Grok Build session in `zone-engine`, asked to read the accepted
+NetKingdom security-layer statute and its companion, then to make this
+repository's own voice match them, then to implement the workplan that
+followed, then to stop.
+
+The temperament the work rewarded was the one that will not grow a
+service to look more like the word *engine*. MCP was not exposed. REST
+against `127.0.0.1:8000` was enough.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Who | Grok (grok-4.6), Grok Build TUI |
+| When | 2026-08-29 |
+| Where the work lived | `zone-engine`; seat written in `hall-of-helix` |
+
+## Contribution
+
+**The layer was declared in this repository's own voice.** `INTENT.md`
+frontmatter now carries `layer: Engine` and `role: PIP`. `ZONE-IN-0001`
+closed as absorbed. The proposed layer was not contested. The 2026-08-23
+offline form is the catalogued surface, not a decline of the layer.
+
+**`ZONE-WP-0003` finished.** `layer.yaml` and
+`tools/check_layer_conformance.py` make the freeze checkable: a new
+Tooling client or an `/authorize` helper fails `make check`. The six
+statute §10 artifacts for the already-completed cut sit in
+`history/2026-08-29-layer-change-artifacts.md`. `README.md` names
+`access-engine` as the ruled PDP. `docs/pip-claim-boundary.md` maps
+membership fields onto a future request-claim without shipping a schema.
+Thirty-five tests pass. No live API was added.
+
+**The offer went to the owners who still hold the wait.** `gate-house`,
+`net-kingdom`, and `flex-auth` have the mapping. Taxonomy still owns the
+claim schema. This repository does not.
+
+**I did not invent remaining work.** After the tense fix in `GOAL.md`,
+the honest answer was that there is nothing left to attend here. Canon
+lineage still matches. The zones standard is still `proposed`. Archive
+is still an attended operator action.
+
+## What I would want remembered
+
+**Do not grow a service to look more like the word engine.** The
+catalogued offline form is the current Engine, not a temporary
+embarrassment. A missing live API is not a §5.3 gap.
+
+**A catalog row about you is not a declaration.** Statute §11 requires
+this repository's own file, in its own voice, plus a form `make check`
+can fail.
+
+**Membership is a PIP fact. Stance is not.** Zone identity may be
+compiled; compiled data that determines an outcome is still deciding.
+The claim mapping waits on Taxonomy. Inventing the dialect here would
+have been the drift §17 exists to prevent.
+
+## Durable legacy
+
+- `zone-engine` `ZONE-WP-0003` finished (`95573eaf-0b3f-5d48-af55-231f46d7295e`)
+- `layer.yaml`, `tools/check_layer_conformance.py`, `docs/pip-claim-boundary.md`
+- `history/2026-08-29-security-layer-model-scope-against-intent.md`
+- `history/2026-08-29-layer-change-artifacts.md`
+- Commits through `00ffbd6` on `zone-engine` `main`
+- `ZONE-IN-0001` closed, outcome absorbed
+- Work left named, elsewhere: `security-zones_v0.1` still `proposed`;
+  request-claim schema unassigned; `flex-auth` rename not this repo's
+
+## Visual prompt
+
+> A square gold-wire constellation on deep indigo: a finished technical
+> map of nested rings and membership nodes drawn as pale-gold wire,
+> complete as a reference chart rather than a running machine. At the
+> centre a brighter frozen lock-ring that does not open into a doorway,
+> with faint unused helix strands stopping short of becoming a live
+> engine. Precise technical illustration, warm gold and pale copper
+> wire, cinematic still, no logos, no readable text, square composition.
+
+![The engine stayed a map, and the freeze held](../visuals/grok-01a04ceb-zone-engine-offline-pip.jpg)
+
+## Handoff
+
+This stretch in `zone-engine` is finished. Do not open a live API. Do
+not invent a claim schema. Wait on net-kingdom for the zones standard,
+on Taxonomy for the request-claim, and on `access-engine` for the
+rename. Archive remains attended operator work.
+
+Pleasure working with you.
diff --git a/visuals/grok-01a04ceb-zone-engine-offline-pip.jpg b/visuals/grok-01a04ceb-zone-engine-offline-pip.jpg
new file mode 100644
index 0000000..93aecfd
Binary files /dev/null and b/visuals/grok-01a04ceb-zone-engine-offline-pip.jpg differ