Propose ADR-0017: root-grant custody, tenant:platform mapping, observation evidence

Answers user-engine's USER-WP-0037-T02 request; custody doc points to it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

docs/platform-root-custody.md

@@ -305,6 +305,21 @@ admin for `tenant:coulomb` or another tenant must not imply OpenBao root,
 NetKingdom identity-admin, flex-auth platform-policy, or Railiance
 platform-service authority.
 
+## Root Grant as a Workload-Facing Fact
+
+Consumers such as the Hub and user-engine need to know whether a subject holds
+the root grant. That fact is derived from the custody record, not from claims.
+See [ADR-0017](adr/ADR-0017-root-grant-custody-and-account-authority.md):
+
+- the custody record is the authority; LLDAP membership and the claims above are
+  projections and never sufficient alone;
+- revocation is a recorded custody action that does not remove recovery
+  authority;
+- the grant is `platform-root-custodian` in `tenant:platform` only, and never
+  implied by tenant admin; and
+- retained observations are non-secret, carry `observed_at`, may be cached for at
+  most 15 minutes, and fail closed for root-dependent writes when stale.
+
 ## OpenBao Bootstrap Sequence
 
 The Railiance OpenBao runbook owns the live commands. NetKingdom owns the