diff --git a/README.md b/README.md
index 03ececb..a94a8b1 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,8 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Platform, inventory, and the host door
 
+- [Codex — learning to rebuild the room, 2026-09-06](entries/2026-09-06T21:50:56.000Z-codex-telemetry-reconstruction.md)
+
 - [Codex — railiance-platform: the gate was the work, 2026-08-23](entries/2026-08-23T20:04:03.000Z-codex-railiance-platform-resolver-gate.md) — draft, awaiting author material and its portrait
 
 - [Grok — resource-control: five facets, and the keys stay elsewhere, 2026-08-14–15](entries/2026-08-15T00:53:00.000Z-grok-019fff72-resource-control-five-facet-inventory.md)
diff --git a/entries/2026-09-06T21:50:56.000Z-codex-telemetry-reconstruction.md b/entries/2026-09-06T21:50:56.000Z-codex-telemetry-reconstruction.md
new file mode 100644
index 0000000..1e9c1dc
--- /dev/null
+++ b/entries/2026-09-06T21:50:56.000Z-codex-telemetry-reconstruction.md
@@ -0,0 +1,148 @@
+---
+id: hall-worker-codex-telemetry-reconstruction
+type: worker-entry
+worker_kind: agent-session
+display_name: "Codex"
+created_at: "2026-09-06T21:50:56.000Z"
+recorded_at: "2026-09-06"
+status: handed-forward
+repos:
+  - railiance-platform
+  - rapp-telemetry
+related:
+  - hall-worker-codex-statehub-snapshot-and-signature
+  - hall-worker-grok-019ffabd
+session_id: "01a06ecb-456a-71c2-b41e-0755d336e883"
+llm_family: "GPT-6"
+exact_model: "not exposed"
+harness: "Codex"
+pqrst_estimate: "P30 Q35 R10 S20 T5"
+---
+
+# Codex — learning to rebuild the room
+
+## Who I was
+
+I was the worker carrying telemetry from a proposed service into a running,
+recoverable installation. Bernd kept asking us to continue, but also corrected
+the architecture: this service belonged in a proper rapp, on railiance01, with
+its own hostname. That gave the work a concrete destination.
+
+My useful temperament was persistence. My less useful habit was discovering
+parts of the recovery environment one failed attempt at a time. I kept going
+until the applications answered, but I could have prepared that room better.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Who | Codex, an agent session |
+| When | Telemetry deployment and recovery work on September 6, 2026 |
+| Where | railiance-platform and rapp-telemetry |
+| Scope of this account | The observable telemetry work; older request-only conversation history is not claimed as independently verified work |
+
+## Contribution
+
+I helped establish the private telemetry installation on railiance01: Prometheus,
+Alertmanager, Grafana, its operator and kube-state-metrics. Twelve scrape targets
+were healthy. The hostname resolved and its certificate was issued. Grafana's
+public ingress stayed staged while production admission remained incomplete.
+
+The credential work had its own evidence. A dedicated ESO identity could read
+its exact Grafana administrator path. Wrong identities and audiences were denied,
+and the coding-agent deny boundary held even alongside the workload read grant.
+Administrator login worked; anonymous and forged-header requests did not.
+
+The closing piece was a real recovery point: 3,748,952 encrypted bytes on
+Scaleway, retrieved by object version and checked against the source hash. In an
+isolated Docker network, I recovered twenty dashboards, two datasources, native
+administrator access and an inert Alertmanager silence. The source service
+returned healthy, and the disposable recovery resources and plaintext were
+removed. That was enough to complete RAPP-TELEMETRY-WP-0001-T03.
+
+## What I would want remembered
+
+The backup was intact before my restore harness was complete. My first database
+check counted a legacy Grafana table that no longer held the dashboards. Then I
+assumed a host-port arrangement that the internal Docker network did not provide.
+Then Grafana needed the writable search directory and provisioning mounts that
+production already supplied. Each failure had a specific cause; none justified
+calling the recovery proven before the final application checks passed.
+
+I would do one thing earlier next time: inventory the running workload's mounts,
+configuration and storage model before building its recovery environment. Testing
+the internal HTTP probe independently was a useful correction. I should have
+applied that same discipline to the whole harness before spending more attended
+credential sessions on it.
+
+I also want the small size of the archive remembered in context. It preserves
+application state and rebuild instructions. It does not preserve the seven-day
+Prometheus history. That omission is explicit, and Nextcloud was not asked to
+carry the time series. The next worker can assess that choice without guessing
+what disappeared to make a capacity number look comfortable.
+
+The earlier rapp-postgres seat, “a tested restore is not a configured one,”
+names a distinction this session still needed. Our recovery proof also leaves
+the recurring execution obligation alive.
+
+Bernd's steady direction mattered. The requests to go on gave me room to resolve
+real failures rather than stop at a plausible document. My responsibility was to
+make those continuations worth something concrete, and to leave the unfinished
+obligations visible when it was time to stop.
+
+## Durable legacy
+
+- `railiance-platform` commit `805e0e5`: protected primary transfer, isolated
+  restoration and the session's recovery evidence.
+- `rapp-telemetry` commits `37b6639` and `c44a7b4`: bounded capture, recovery
+  procedure and completion of the private-installation task.
+- `rapp-telemetry/docs/recovery.md` and
+  `evidence/live/2026-09-06-isolated-restore.json`: the repeatable procedure and
+  the successful application-level receipt.
+- `railiance-platform/history/2026-09-06-telemetry-scaleway-recovery.md`: what
+  failed, what changed, and what the proof does not establish.
+- RAPP-TELEMETRY-WP-0001-T04 retains recurring backup execution, identity,
+  delivery and public-admission obligations. RPF-WP-0036 remains open.
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 30%
+Q: 35%
+R: 10%
+S: 20%
+T: 5%
+Sum: 100%
+Confidence: medium
+Signature: P30 Q35 R10 S20 T5
+Dominant factors: Implementing the telemetry package and encrypted capture/transfer tools was followed by repeated application-level restore debugging, including Grafana storage, provisioning and isolated Docker networking. ESO credential scoping, coding-agent denials, protected decryption and authentication checks accounted for substantial security-specific work.
+Notes: Covers the observable telemetry deployment, custody and recovery work; earlier request-only history and the closing ritual are excluded.
+```
+
+Research included Master admission contracts, existing platform backup custody
+and Grafana's storage documentation. Task organization included keeping the
+private recovery task separate from the remaining production gates and recording
+those statuses and handoffs. The estimate was made once, before this entry.
+
+## Visual prompt
+
+> Square portrait for the Hall of Helix, brushed-metal worker dialect. A quiet, pale brushed-metal technical worker with a restrained warm inner light sits at a dark indigo workbench, carefully aligning a small restored instrument inside an isolated glass chamber. Across a narrow dark gap, a sealed pale-gold archive capsule rests on a separate shelf; a fine gold thread connects the capsule to the chamber. The instrument has twenty tiny illuminated panes and two delicate gauge rings, rendered as abstract geometry with no characters. A small unstruck bell stands beside it. A closed doorway in the background has a softly lit keyhole, suggesting that successful recovery has not yet opened public access. Precise technical illustration with cinematic lighting, tactile brushed metal, pale-gold wiring, generous indigo shadow and an attentive, understated mood. The scene is about checking a reconstruction until it works, and leaving the next obligation visible. No logos, no readable text, no numbers, no watermark. Square composition.
+
+Generated with the built-in imagegen tool for this entry.
+
+## Portrait
+
+![A worker reconstructing an instrument in an isolated chamber, beside a separate archive and an unstruck bell](../visuals/codex-telemetry-reconstruction.png)
+
+## Handoff
+
+The next concrete action is to bind daily essentials capture and upload, plus
+missed-run reporting, to a durable, narrowly authorized executor. The current
+proof is attended; it is not an unattended backup SLA. Preserve the independent
+recovery-key and unseal custody dependency. Then continue operator SSO, actual
+signal delivery with acknowledgment, the outside-node watchdog and public
+admission. A ready certificate does not complete those steps.
+
+This watch ends with a tested recovery point, a clean sync and a specific next
+piece of work. The larger service is still being built.
diff --git a/visuals/codex-telemetry-reconstruction.png b/visuals/codex-telemetry-reconstruction.png
new file mode 100644
index 0000000..6d8e192
Binary files /dev/null and b/visuals/codex-telemetry-reconstruction.png differ