docs(nk-wp-0033): record the 2026-08-27 attended session findings

platform-root login is restored and the resolver holds the current bind
credential, so T04's outstanding reconciliation is done. No green receipt
yet — the run of record is a FAIL at resolver-lookup, and T05 stays open.

Records four things the session established:

- the predecessor is dead, observed twice by hand, but not by receipt;
- the value is unrecoverable, because no KeePassXC database has ever
  existed despite platform-root-custody.md naming a safe entry, and the
  only copy lived in a Firefox entry overwritten during the session.
  T04 replaced the credential with no step to update operator custody —
  the root cause of the whole session;
- the reconciliation script had never completed a run (4a38511);
- verify-t06.sh reported success at bootstrap against a resolver that
  was misconfigured and a reconciliation path that could not execute.
  That blind spot is open and is the finding worth acting on.

Also corrects the record: the stale bind credential was real but did not
cause the lookup failure. The HTTP 400 was our own request builder.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166

docs/keycape-exposure-resolver-reconciliation.md

@@ -2,7 +2,7 @@
 
 Incident: `KEYCAPE-EXPOSURE-20260823-01`  
 Workplan: `NK-WP-0033`  
-NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (revision pinned by the approved checkout)
+NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (repaired 2026-08-27 in `4a38511`; the previously pinned revision could not complete a run — see NK-WP-0033 T05)
 Platform recovery contract: railiance-platform `453fed3`  
 Owner cutover receipt: State Hub message `45b236c8-052f-43d3-a472-44f8e9694da2`
 
@@ -99,3 +99,27 @@ T03 may move to done only after the helper run and cleanup receipt are recorded
 by the attended operator. T05 may move to done only after the resolver’s
 replacement success, predecessor denial, owner cutover receipt, and all
 residual limitations are recorded as sanitized evidence.
+
+## Revision note — 2026-08-27
+
+The pinned revision of `reconcile-lldap-resolver-live.sh` had never completed a
+run. Four defects were found by running it and are fixed in `4a38511`; see
+`NK-WP-0033` T05 for the full findings. Two change how this procedure is
+invoked:
+
+- `--predecessor-unavailable` — use when the exposed predecessor cannot be
+  produced. The denial bind is not attempted and the receipt records
+  `predecessor denial=NOT-PROVEN`. Do **not** type a placeholder at the
+  predecessor prompt instead: a wrong value also fails the bind, and the run
+  records it as a *passing* denial proof — a receipt asserting a test that never
+  ran.
+- `--note TEXT` — operator context carried verbatim in the receipt line, so a
+  claim and its caveat travel together. One line, 200 characters, no
+  credentials.
+
+`TIMEOUT`, `CACHE_TIMEOUT` and `SIZELIMIT` are now sent with the resolver body
+(default 5 / 120 / 500, overridable via the matching `LDAP_*` environment
+variables). Before this fix, `--apply` dropped them, because a resolver write
+replaces the whole object. A resolver with them unset still resolves users, but
+the WebUI refuses to save or test it — so a hand repair was silently reverted by
+the next run.