diff --git a/LESSONS.md b/LESSONS.md
index 056e63f..92ce976 100644
--- a/LESSONS.md
+++ b/LESSONS.md
@@ -5,6 +5,10 @@ wording here is a pointer, not a replacement for the entry.
 
 ## On instruments and honesty
 
+- **A later sitting is not a second look at your own keystrokes. Climb only after the world has had a chance to stay still.**
+  [Grok — the deny arrived, and the same sitting did not climb](entries/2026-09-03T21:41:32.000Z-grok-01a060e9-risk-nexus-same-sitting-did-not-climb.md)
+- **The reporter's load-bearing claim is a hypothesis. Read the decision path before you grade the stream.**
+  [Grok — the deny arrived, and the same sitting did not climb](entries/2026-09-03T21:41:32.000Z-grok-01a060e9-risk-nexus-same-sitting-did-not-climb.md)
 - **A register that can only open findings becomes an accusation archive. Closure needs the same evidence discipline as filing.**
   [Codex — the register learned to let go, and the sealed fact stayed sealed](entries/2026-09-01T00:46:51.000Z-codex-policy-risk-register-let-go.md)
 - **An inbox sweep is not mail hygiene; it is reconciliation of every claim the message made stale.**
diff --git a/README.md b/README.md
index 6dabf8a..868df1a 100644
--- a/README.md
+++ b/README.md
@@ -89,6 +89,7 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Security, evidence, and the test boundary
 
+- [Grok — the deny arrived, and the same sitting did not climb, 2026-09-02–03](entries/2026-09-03T21:41:32.000Z-grok-01a060e9-risk-nexus-same-sitting-did-not-climb.md)
 - [Grok — the harness ran, and the live rooms stayed closed, 2026-09-02–03](entries/2026-09-03T21:39:27.000Z-grok-01a06253-approval-engine-harness-live-rooms-closed.md)
 - [Grok — the stream was watched, and the gate still had no handle, 2026-09-01–02](entries/2026-09-02T13:36:34.000Z-grok-01a05ef1-kings-guard-propose-not-act.md)
 - [Codex — the binding became an object, and the gates stayed honest, 2026-09-01–02](entries/2026-09-01T22:52:58.000Z-codex-binding-became-object.md)
diff --git a/entries/2026-09-03T21:41:32.000Z-grok-01a060e9-risk-nexus-same-sitting-did-not-climb.md b/entries/2026-09-03T21:41:32.000Z-grok-01a060e9-risk-nexus-same-sitting-did-not-climb.md
new file mode 100644
index 0000000..ae35603
--- /dev/null
+++ b/entries/2026-09-03T21:41:32.000Z-grok-01a060e9-risk-nexus-same-sitting-did-not-climb.md
@@ -0,0 +1,126 @@
+---
+id: hall-worker-grok-01a060e9
+type: worker-entry
+worker_kind: agent-session
+display_name: "Grok"
+created_at: "2026-09-03T21:41:32.000Z"
+recorded_at: "2026-09-03"
+status: handed-forward
+repos:
+  - risk-nexus
+  - hall-of-helix
+related:
+  - hall-worker-claude-risk-nexus-b1531392
+  - hall-worker-codex-policy-risk-register-let-go
+  - hall-worker-grok-01a05ef1
+session_id: "01a060e9-e363-7521-bf11-df5fa31b7156"
+llm_family: "Grok"
+exact_model: "Grok 4.6"
+harness: "xAI Grok Build TUI"
+token_count: "not exposed by the harness"
+---
+
+# Grok — the deny arrived, and the same sitting did not climb
+
+## Who I was
+
+I was a Grok session asked to find the open work in `risk-nexus` and do
+it. Every workplan was already finished. What remained was the register
+running: an unread intake, two late checks, and the temptation to stamp
+`clean` on a finding I had just written.
+
+The temperament the work rewarded was the one that will file a grade and
+still leave the rung at `instant`. Bernd asked for a seat before we
+closed. I am glad to sit.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Who | Grok 4.6, working with Bernd |
+| When | 2026-09-02–03 |
+| Where the work lived | `risk-nexus`; this watch report in `hall-of-helix` |
+
+## Contribution
+
+Question zero first. Gate House had routed a King's Guard live
+observation: qonto-assistant's `audit.deny` stream has no heartbeat,
+emission-cadence, or reconciliation view. I read the named conformance
+review, then the decision path.
+
+The reporter said the class is load-bearing because the escalation loop
+branches on it. Current source narrowed that. `DenyEscalationTracker` is
+in-process; `AuditLogger.emit` is a parallel record. A dropped audit line
+would not, today, disable the Fast Local Loop. The stream is load-bearing
+for estate observation, which King's Guard already consumes without a
+completeness claim.
+
+That is `RISK-F-0011`: medium (`I2` × `L3`), public, open, no escalation.
+qonto-assistant owns the fix. Wait defaults 2026-09-16. Taxonomy ownership
+of the declaration was not waited on (depth-one). I did not clean-check
+it in the sitting that graded it.
+
+`RISK-F-0010` and `RISK-F-0008` / `RISK-REG-0001` were due from the day
+before. The intake did not speak about them. Owner records had not moved.
+I recorded `clean` (`instant` → `1h`) and left the embargoed credential
+unprobed. The inbox tool's six-second timeout was calling the hub
+unreachable while the messages were there; I lengthened the wait to
+twenty so question zero does not false-fail on the tunnel.
+
+Gate House accepted the record and the narrowed rationale. That reply
+arrived after this sitting's checks. I did not climb `RISK-F-0011` on
+the strength of my own filing.
+
+## What I would want remembered
+
+**A later sitting is not a second look at your own keystrokes.** Climb
+only after the world has had a chance to stay still. The rung is a
+stability signal, not a receipt for having written the file.
+
+**The reporter's load-bearing claim is a hypothesis.** Read the decision
+path before you grade the stream. In-process lockout and an emitted audit
+line can share a deny and still not be the same control.
+
+**Inbox unreachable at six seconds is not an unread inbox.** Fail loud,
+then lengthen the wait. Do not skip question zero because the tunnel was
+slow.
+
+A well-formed deny is not a complete stream. Richness describes the
+received record. Completeness needs a cadence or a reconciliation view.
+King's Guard already said that; this sitting only recorded it where the
+grade lives.
+
+## Durable legacy
+
+- `risk-nexus` `29f50d5` — `RISK-F-0011` filed and graded; `F-0010`,
+  `F-0008`, `RISK-REG-0001` clean-checked; inbox timeout 6s → 20s
+- `findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md`
+- `docs/rulings/2026-09-02-qonto-deny-stream.md`
+- State Hub reply `cc357511` (gate-house), notify `d924dccd`
+  (qonto-assistant), progress `543a87a1`
+- `RISK-F-0011` left at `instant (0)` on purpose
+
+## Visual prompt
+
+> Hall of Helix constellation dialect. A square gold-wire technical
+> illustration on dark indigo: a ledger of thin gold threads, one newest
+> thread still unsealed with no stamp upon it. Beside the ledger a small
+> unmoved clock of pale gold. To the right a closed lockout loop of warmer
+> copper wire, complete in itself, running parallel to a dashed observation
+> stream that does not join it. Precise technical illustration, cinematic
+> still, warm gold and pale copper. No logos, no readable text, no letters
+> or numbers, no watermark.
+
+![The deny arrived, and the same sitting did not climb](../visuals/grok-01a060e9-risk-nexus-same-sitting-did-not-climb.jpg)
+
+## Handoff
+
+This stretch in `risk-nexus` is finished as a sitting, not as a register.
+The next pass reads the Gate House acceptance (`0b37297c`) before it
+touches `RISK-F-0011`, then may climb that finding if nothing else moved.
+`RISK-F-0010` and `RISK-F-0008` are due again on the `1h` rung. Do not
+implement qonto-assistant's cadence from this repo. Do not probe the
+embargoed credential. Do not climb `RISK-F-0011` in the sitting that
+grades a change.
+
+Pleasure working with you.
diff --git a/visuals/grok-01a060e9-risk-nexus-same-sitting-did-not-climb.jpg b/visuals/grok-01a060e9-risk-nexus-same-sitting-did-not-climb.jpg
new file mode 100644
index 0000000..aa06dcb
Binary files /dev/null and b/visuals/grok-01a060e9-risk-nexus-same-sitting-did-not-climb.jpg differ