Record failed custody finish diagnosis and tested recovery helper repair

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -373,3 +373,19 @@ in owner source commit `a252447058105eed0931d34f1a906f39ce7c2e5e` and retrieved
 through a fresh remote clone with exact byte matching. That proves remote source
 retrieval, not a provider archive generation. The attended direct history backup
 roundtrip is the remaining evidence gate.
+
+Attended finish attempt `20261003T185421Z-333977` failed before receipt creation;
+session was revoked. Audit verifies its custody and both backup bundle reads
+were successful; exact subsequent roundtrip failure remains unproven. Producer
+is repairing safe diagnostics and full-command test coverage before retry.
+T05 remains wait and the plan blocked; no provider success is claimed and no
+new credential admission or generic approval is inferred from this failure.
+
+Producer repair `33ff822` now reserves a private fresh receipt before dependency
+imports, emits only fixed stage/error codes and safe HTTP/artifact metadata, and
+checks the existing independent escrow key for recovery. Thirty-two tests passed,
+including full command startup/success/failure under private attended HOME with
+real validator/age crypto and disposable backend/provider fixtures. Parent
+installed-wrapper smoke confirmed non-attended execution is refused with safe
+failure receipt. The same attended command is ready with a newly generated run
+ID; actual provider failure/success is not inferable until that receipt exists.