Fix attended login result auditing and reconcile blocked workplans

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6ef-4273-7fc2-8741-dc96b3e5fe0d

workplans/WARDEN-WP-0034-layer-model-v07-conformance.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule"
 domain: infotech
 repo: ops-warden
-status: active
+status: blocked
 flavor: implementation
 depends_on:
   - WARDEN-WP-0030
@@ -14,7 +14,7 @@ planning_priority: P1
 depends_on_workplans:
   - WARDEN-WP-0030
 created: "2026-08-29"
-updated: "2026-09-21"
+updated: "2026-09-28"
 state_hub_workstream_id: "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef"
 ---
 
@@ -336,3 +336,12 @@ layer-conformance script, and the declaration-route CLI smoke check pass.
 - `security-layer-model_v0.7.md` §3.4, §6.4, §9.6, §9.7, §11, §13.1
 - `net-kingdom/SECURITY-COMPANION.md` v0.2
 - `ADR-0002`, `ADR-0003`, `ADR-0004`, `ADR-0005`, `ADR-0009`, `ADR-0010`
+
+### 2026-09-28 loose-end review
+
+T05 remains wait; the workplan is blocked on the two outstanding owner answers.
+The local ops-mason checkout still has no published stance map, and the available
+railiance-infra workplans/docs contain no KRL-versus-TTL acceptance or refusal.
+The flex-auth decision-lifetime answer remains accepted. Warden's declaration,
+TTL-bound tests and fresh-check behavior are complete; inventing an owner answer
+would not satisfy T05. No certificate lifetime or revocation policy was changed.