feat: report bounded verified access dependency readiness

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

workplans/HUB-WP-0012-netkingdom-platform-root-access.md

@@ -408,6 +408,24 @@ Production grants, deployment and live receiver acceptance remain open; no live
 database was contacted or migrated.
 See [test details](../docs/conformance.md#disposable-postgresql-gate).
 
+## Access readiness continuation — 2026-09-28
+
+Replaced controller-presence readiness with named identity/facts/policy/audit
+observations and an aggregate. Missing, failed or stale observations fail
+readiness. Observations come from verified operations and never replace access
+checks; invalid tokens cannot poison/refresh dependency health and verified
+policy denials remain healthy evaluations. The controller itself now bounds
+all callers to ten seconds. Readiness remains protected and liveness minimal.
+
+Flex-auth source exposes only liveness; no admitted independent facts health API
+exists. The [readiness contract](../docs/access-readiness.md) explicitly describes
+recent usability rather than inventing an owner probe or claiming reachability.
+Updated conformance to include access and outcome-delivery dependencies.
+T04 remains `progress`; independent owner monitoring and live acceptance remain
+open. Validation: **372 ordinary tests**, **five real PostgreSQL tests** and
+**six owner-source Audit Core tests** pass; inventory, package build and isolated
+wheel validation pass. No deployment or external owner contract changed.
+
 ## Acceptance checkpoints
 
 - [x] Architecture/source/runtime review captured; new implementation owner is hub-core