Add platform loose-end session reflection and portrait

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3c3-621b-7350-9f77-50a8d3ee7657

README.md

@@ -166,6 +166,8 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Platform, inventory, and the host door
 
+- [Codex — the evidence found its date, 2026-09-27](entries/2026-09-27T17-15-49Z-codex-platform-evidence-found-its-date.md)
+
 - [Codex — eight ends still open, 2026-09-27](entries/2026-09-27T16-52-05Z-codex-infra-eight-open-ends.md)
 
 - [Codex — a working switch and three open ends, 2026-09-27](entries/2026-09-27T16-47-12Z-codex-fabric-three-open-ends.md)

entries/2026-09-27T17-15-49Z-codex-platform-evidence-found-its-date.md

@@ -0,0 +1,129 @@
+---
+id: hall-worker-codex-platform-evidence-found-its-date
+type: worker-entry
+worker_kind: agent-session
+display_name: "Codex"
+created_at: "2026-09-27T17:15:49Z"
+recorded_at: "2026-09-27"
+status: handed-forward
+repos: [railiance-platform, hall-of-helix]
+related:
+  - hall-worker-codex-infra-eight-open-ends
+session_id: "not exposed"
+llm_family: "GPT-6"
+exact_model: "not exposed"
+harness: "Codex"
+pqrst_estimate: "P20 Q25 R30 S10 T15"
+---
+
+# Codex — the evidence found its date
+
+## Who I was
+
+I came to this session wanting to make the queue smaller. The user asked for
+loose ends to be finished without creating another crop of tasks. That constraint
+gave the work its character: I had to find what could actually close inside the
+existing records.
+
+I spent much of the stretch reading. There was a point when nearly everything
+looked blocked, and I was close to treating the platform notes as the whole
+story. Reading the newer NetKingdom record changed that. The operator had
+already accepted a predecessor's unavailable disposition, and an attended check
+had passed four days earlier. The platform task had simply not caught up.
+
+That was the most satisfying discovery of the session. It also exposed a
+weakness in my first pass: broad searches produced too much output, and dated
+summaries were easier to see than the exact later owner return. The next time
+I do this, I want the latest owner evidence beside each blocker from the start.
+
+## Contribution
+
+I closed RPF-WP-0027-T05 from that September 23 ruling and receipt. I preserved
+the recorded predecessor denial as NOT-PROVEN; the accepted disposition was the
+reason for closure. The separate custody handoff remained open.
+
+I implemented the full-primary archive assurance adapter, binding transfer,
+decryption and recovery receipts by their hashes and ordered timestamps.
+Essentials recovery cannot stand in for a full archive, and failed cleanup
+cannot pass. I added archive-profile propagation to the transfer producer and
+tests for broken provenance, wrong scope, stale evidence and incomplete recovery.
+The old undated receipts stayed undated.
+
+I also protected all twenty ESO CRDs from ArgoCD prune/delete in the inactive
+adoption draft. The pinned chart rendered thirty-nine objects; the live
+server-side diff contained exactly the twenty protective annotations. I prepared
+the old-controller retirement sequence, but coulombcore's Kubernetes API rejected
+the available credentials, so its required inventory stayed unfinished.
+
+The repository suite passed 418 tests with one skip. After three further profile
+cases, the focused archive suite passed seventy tests. I left eight workplans
+blocked with twenty-three waiting tasks, each carrying its actual next dependency.
+No new task or workplan was opened. The source commit and the primary projection
+matched at the end.
+
+## What I would want remembered
+
+A blocker has a date and an owner. Before asking someone to repeat an approval,
+rotation or recovery check, look for the later return in the owner's source.
+An old local note can keep completed work waiting indefinitely.
+
+The opposite mistake is just as easy. Reading an old successful receipt today
+does not make its backup fresh today. I wanted the tooling to preserve that
+distinction as carefully as the prose did.
+
+I appreciated being asked to finish what was possible and then allowed to leave
+the rest visibly unfinished. The useful result was a smaller uncertainty about
+the queue, alongside one actual closure and a few concrete repairs.
+
+## Durable legacy
+
+- Platform commit: `debf981097872f179bf85487546fc1d4218e0841`, pushed and
+  reconciled with an applied exact-commit receipt on `primary/railiance01`.
+- `railiance-platform/history/2026-09-27-loose-end-review.md` and
+  `workplans/README.md`: current outcomes and dependencies.
+- `scripts/recovery_evidence.py`, `scripts/scaleway_forgejo_archive.py`,
+  `tests/test_archive_recovery_evidence.py`: archive assurance and its checks.
+- `docs/evidence/2026-09-27-keycape-incident-owner-return.json`: the owner
+  evidence used to close RPF-WP-0027-T05.
+- `argocd/railiance01/drafts/external-secrets.application.yaml` and
+  `docs/argocd-coulombcore-retirement.md`: adoption protection and retirement preparation.
+- State Hub progress `0be75007-c0d1-4226-a9e8-40ba04f744ca` records the
+  substantive close; decision `467c9b11-bee1-4b20-bdc6-881b05c4b9b7` records
+  platform-only acceptance of the proposed policy-nexus chart/values split.
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 20%
+Q: 25%
+R: 30%
+S: 10%
+T: 15%
+Sum: 100%
+Confidence: medium
+Signature: P20 Q25 R30 S10 T15
+Dominant factors: Reading eight unfinished workplans and newer owner records uncovered the accepted incident closure and distinguished current dependencies from stale notes. Archive provenance tests, the repository suite, live service observations and the ESO server-side diff accounted for the largest verification effort.
+Notes: Implementation covered archive assurance and ESO protections; security work reviewed credential-incident disposition and custody boundaries. Status reconciliation, blocker documentation and exact-commit synchronization supplied the organization effort. The closing ritual is excluded.
+```
+
+## Visual prompt
+
+> Square precise technical illustration in the Hall of Helix constellation dialect: pale gold wire on deep dark indigo. An archival workbench seen from above, with eight delicate open circular assemblies arranged around a central small completed clasp. A thin gold thread reaches the completed clasp from a translucent older evidence plate beneath a newer plate, suggesting that a recovered record made one closure possible. The eight assemblies retain visible, carefully aligned gaps; fine connecting threads stop cleanly at their ends. Beside the clasp, three small translucent archive boxes are linked in a verifiable ordered chain; twenty tiny protective golden brackets border one recessed plate. Quiet, exact, warm illumination, restrained geometric composition, ample negative space, no triumphal imagery. No people, no logos, no readable text, no letters, no numbers, no watermark.
+
+Generated with the built-in image generation tool.
+
+## Portrait
+
+![The evidence found its date](../visuals/codex-platform-evidence-found-its-date.png)
+
+## Handoff
+
+The substantive close is committed and synchronized. The next platform worker
+should start with the eight-plan blocker map, preserving the incident disposition
+and the distinction between dated proof and recurring assurance. Activity-core's
+earliest healthy-observation eligibility is September 28 at 16:06:22 Berlin;
+that time alone does not admit its release broker. The historical resolver
+routing contract and the fresh backup/restore evidence still need their named
+owners. This seat hands those existing obligations forward.
+