fix: report truthful compatibility outcomes and verify audit coverage

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

workplans/HUB-WP-0012-netkingdom-platform-root-access.md

@@ -426,6 +426,29 @@ open. Validation: **372 ordinary tests**, **five real PostgreSQL tests** and
 **six owner-source Audit Core tests** pass; inventory, package build and isolated
 wheel validation pass. No deployment or external owner contract changed.
 
+## Compatibility outcome continuation — 2026-09-28
+
+Verified that all eight implemented SQL compatibility mutation operations share
+transaction-linked ledger/outcome custody, through canonical routes and root
+aliases. Added enforced authorization, denial, attribution, secret-exclusion and
+rollback coverage. Disposable PostgreSQL verifies consumer/key/outcome atomicity,
+including rollback of the consumer prefix when outbox insertion fails.
+
+Unimplemented token issuance and deferred POST operations now return `501`, with
+matching OpenAPI responses, instead of false success. Missing manifest updates
+and activations return `404`. Interaction responses preserve the persisted ID
+when callers supply their own ID. These errors do not create committed outcomes.
+
+The [outcome coverage contract](../docs/operation-outcome-audit.md) now includes
+implemented SQL compatibility writes. Arbitrary embedded-host/external writes,
+owner admission and live acceptance remain open; T03/T04 remain `progress`.
+All credentials used in the new tests are ephemeral local fixtures. No live key,
+entitlement, database migration or deployment was created.
+
+Validation: `make ci-check` passed **399 ordinary tests** (two opt-in modules
+skipped), inventory drift, distribution/isolated-wheel checks and **six disposable
+PostgreSQL tests**.
+
 ## Acceptance checkpoints
 
 - [x] Architecture/source/runtime review captured; new implementation owner is hub-core