diff --git a/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md b/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md
index 998ea02..99fb0ce 100644
--- a/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md
+++ b/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md
@@ -47,6 +47,20 @@ reported:
 This baseline is not reusable as the final hold-point result. The platform
 owner must rerun it against the current state and fresh snapshot receipt.
 
+## Fail-closed preparation probes
+
+- The OpenBao pod token helper and the current workstation caller token both
+  receive `403 permission denied` for a capabilities check on
+  `sys/storage/raft/snapshot`. No snapshot command was attempted after that
+  denial. The platform driver must use its attended owner identity; the agent
+  will not widen a workload token or substitute root.
+- Warden has no autonomous provider-console catalog lane. Independent console
+  access therefore remains an explicit `railiance-infra` owner attestation,
+  not an inferred result from SSH reachability.
+- The live barrier reports three shares and threshold two, but state metadata
+  cannot prove two custodians are currently present. Availability must arrive
+  through the out-of-band custody authority without identities or values.
+
 ## Pending receipts
 
 - [ ] `railiance-platform`: fresh encrypted, verified, off-host OpenBao Raft