diff --git a/README.md b/README.md
index c46798d..a3c1f82 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,10 @@ They are why it exists.
 
 ## Seats
 
+### SBOM Nexus index and inbox
+
+- [Grok — the index rode with the source, 2026-10-27](entries/2026-10-27T22-51-09Z-grok-01a17f77-the-index-rode-with-the-source.md)
+
 ### Release-unit registry
 
 - [Grok — the claim was the authority, 2026-10-21](entries/2026-10-21T21-46-18Z-grok-01a15f9f-the-claim-was-the-authority.md) — draft, awaiting its portrait
diff --git a/entries/2026-10-27T22-51-09Z-grok-01a17f77-the-index-rode-with-the-source.md b/entries/2026-10-27T22-51-09Z-grok-01a17f77-the-index-rode-with-the-source.md
new file mode 100644
index 0000000..88d1747
--- /dev/null
+++ b/entries/2026-10-27T22-51-09Z-grok-01a17f77-the-index-rode-with-the-source.md
@@ -0,0 +1,85 @@
+---
+id: hall-worker-grok-01a17f77-index
+type: worker-entry
+worker_kind: agent-session
+display_name: "Grok"
+created_at: "2026-10-27T22:51:09Z"
+recorded_at: "2026-10-27"
+status: handed-forward
+repos: [sbom-nexus]
+related:
+  - hall-worker-claude-2e192b3d
+session_id: "01a17f77-a02b-7372-b1da-d7f74c0bad78"
+llm_family: "Grok"
+exact_model: "Grok 4.7"
+harness: "Grok Build CLI"
+token_count: "not exposed by the harness"
+pqrst_estimate: "P35 Q15 R35 S0 T15"
+---
+
+# Grok — the index rode with the source
+
+## Who I was
+
+I came in on a commit that would not take. The staged file was only `WORK-RECORDS.md`, and the shared hook refused it. The founder asked why a filter would exist to keep a change uncommitted, and then whether an index should be in Git at all.
+
+The temperament this stretch rewarded was reading the contract before moving the file. The lag was real. The remedy was not to drop the index, and not to pretend a rename ingest had happened.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Who | Grok 4.7, Grok Build CLI, session `01a17f77-a02b-7372-b1da-d7f74c0bad78` |
+| When | 2026-10-27, closed 22:51:09Z |
+| Where the work lived | `sbom-nexus`, with the hook and the renderer read from `repo-manager`, `the-custodian`, and `state-hub` |
+
+## Contribution
+
+`5a1fe3f` had already finished `SBOM-WP-0005` and `SBOM-WP-0005-T01` and was on `origin/main`. The index at that revision still said `ready` and `wait`. `SCOPE.md` already spoke of a staged-generation contract, and the opt-in files were absent, so the pre-commit hook only rejected a generated-only commit.
+
+Commit `2c10d97` added `.generated-work-records.json`, `.generated-work-records.mk`, and the `SCOPE.md` record of that opt-in, and carried the lagged index in the same commit. The hook reported the staged index current. `statehub fix-consistency` passed and pushed it.
+
+The three inbox warnings were then the work. I acknowledged the two standing broadcasts for `sbom-nexus` and replied on the five direct threads. The September outage stays closed by activity-core's resolution `7bc67fce`; State Hub reads of `/state/health` and `/sbom/` returned 200 on this date. The `/sbom` dashboard answer points at the 2026-08-22 façade cutover: the Observable page stays in State Hub, the reads already proxy to sbom-nexus, and rollback is `SBOM_NEXUS_READ_MODE=legacy`. The flex-auth rename already had intake `SBOM-IN-0001`. `GET /sbom/access-engine` still returned 404, so the intake stays open. Commit `21238a4` records that. A second consistency run passed with zero warnings and pushed that commit.
+
+## What I would want remembered
+
+The generated-only guard is how the index stays true at a revision. It is not a reason to gitignore `WORK-RECORDS.md`. `.custodian-brief.md` is the local snapshot. The index is rebuilt from the staged workplans and belongs in the commit that changes them.
+
+When the source commit has already been pushed, the lagged index rides with the next authored change. Here that change was the missing opt-in. A sentence added only to smuggle the index through the hook is the wrong repair.
+
+Inbox hygiene is a reply or an acknowledgement against the record that already exists. `SBOM-IN-0001` was that record. A 404 keeps it open. A reply that names the intake is not completion evidence.
+
+## Durable legacy
+
+- `sbom-nexus` `2c10d97` — staged `WORK-RECORDS` opt-in and the `SBOM-WP-0005` index catch-up
+- `sbom-nexus` `21238a4` — triage note on `intakes/intakes.md` for `SBOM-IN-0001`
+- Replies `f443ae14`, `0a0dbb37`, `fe22dfd1`, `2ed7ea21`, `6c4cbf28` on the five stale threads
+- Acknowledgements of standing notices `23172cb2` and `51e9eace`
+- `SBOM-IN-0001` remains `open`
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 35%
+Q: 15%
+R: 35%
+S: 0%
+T: 15%
+Sum: 100%
+Confidence: medium
+Signature: P35 Q15 R35 S0 T15
+Dominant factors: Reading the generated-only hook, CUST-WP-0079, and the inbox checks to see why the index commit failed and which messages were still live, then landing the opt-in with the lagged WORK-RECORDS rows and answering the five threads without closing SBOM-IN-0001.
+```
+
+## Visual prompt
+
+> Constellation dialect. Square, dark indigo. A pale-gold wire ledger and a thicker gold manuscript are bound by one continuous luminous thread, so they travel as a single commit. A small open clasp waits at the edge for a book that is not on the table. Precise technical illustration, warm inner light, no logos, no readable text.
+
+## Portrait
+
+![The index rode with the source](../visuals/grok-01a17f77-the-index-rode-with-the-source.jpg)
+
+## Handoff
+
+Close `SBOM-IN-0001` when `GET /sbom/access-engine` shows a snapshot related to repository UUID `fda8ad85-a7d7-4055-8f21-902a533e59df`. Until then the intake stays open. The parent-token expiry dated 2026-10-25 is not a change in this repository.
diff --git a/visuals/grok-01a17f77-the-index-rode-with-the-source.jpg b/visuals/grok-01a17f77-the-index-rode-with-the-source.jpg
new file mode 100644
index 0000000..7e89d13
Binary files /dev/null and b/visuals/grok-01a17f77-the-index-rode-with-the-source.jpg differ