Record functional pilot walkthrough and prepare attended inventory handoff

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1abf1-7e95-7141-87c9-ee78332bf790

docs/evidence/2026-11-05-vergabe-functional-flow-return.json

@@ -0,0 +1,29 @@
+{
+  "schema": "railiance.vergabe-pilot-user-return.v1",
+  "reported_on": "2026-11-05",
+  "workplan": "RAPPS-WP-0014",
+  "task": "RAPPS-WP-0014-T03",
+  "evidence_source": "User confirmation in the active conversation",
+  "evidence_kind": "user_reported",
+  "fixture": {"ausschreibung_id": 1, "aufgabe_id": 1, "dokument_id": 1},
+  "cross_account_task_editing_works": true,
+  "user_reports_flow_completed": true,
+  "final_recorded_phase_user_label": "Zuschlag/Nachlese",
+  "user_assessment": "The flow needs work, but the functionality present seems to work quite well.",
+  "functional_walkthrough_status": "confirmed_with_ui_followup",
+  "ui_review_status": "open",
+  "individual_approval_records_independently_verified": false,
+  "native_inventory_complete": false,
+  "populated_restart_or_recovery_verified": false,
+  "session_or_otp_policy_changed": false,
+  "runtime_mutations_by_agent": false,
+  "remaining_work": [
+    "Attended native release/storage inventory",
+    "File checksum and direct anonymous-download refusal",
+    "Owner-run inactive-session denial",
+    "Populated pod-replacement verification",
+    "Coherent PostgreSQL/media/issue-state off-host recovery point",
+    "Isolated restored workflow and compatible rollback",
+    "Backup and incident/support ownership, cadence, retention and recovery objectives"
+  ]
+}

docs/proposals/2026-11-05-vergabe-recovery-preflight/README.md

@@ -36,6 +36,36 @@ new standing agent grant is requested by the packet. The result must report
 `native_inventory_complete: true` before using its expected release as the
 baseline of a separately reviewed capture/restart operation.
 
+## Founder-terminal handoff
+
+The user has now confirmed cross-account task edits and the functional flow
+through Zuschlag/Nachlese, with UI follow-up. The remaining first step is native
+inventory. A restricted SSH check as `custodian-agt` was refused at authentication;
+the agent did not try an elevated account or issue its own certificate.
+
+From a synced `railiance-apps` checkout on **railiance01**, run:
+
+```bash
+python3 tools/vergabe_pilot_inventory_attended.py --submit
+```
+
+The launcher asks for the **path** to the existing gexec approver key. The normal
+gexec review/signature step follows. It stages the fixed proposal in the existing
+exchange directory, then uses `sudo -u custodian-agt` only to enqueue the signed
+request under the required UID and read its sanitized result. Kubernetes access
+runs through gexec's configured `kube:railiance01` target. The founder needs the
+existing exchange access and ability to use that restricted account via sudo.
+No new key, standing grant or privileged kubeconfig is installed. Keep the
+approver key in its existing custody. If it is held only on the workstation,
+sign the action there with the existing gexec CLI and supply that public signed
+approval on the node with `--submit --approval /path/to/approval.json`; do not
+copy the private key to the node. Gexec verifies the signature and its expiry.
+
+Share the final result JSON. A pending result retains its request ID; inspect
+that request before submitting again. The launcher defaults to local packet
+review when `--submit` is omitted and refuses a changed action digest. The
+existing gated executor remains responsible for signature/nonce/profile checks.
+
 Validation: source compilation and synthetic command responses cover success,
 immediate wrong-cluster refusal, image drift and exclusion of a private canary
 from the receipt. Ruff is unavailable in the current shell. No native pass,

docs/vergabe-demo-company-acceptance.md

@@ -10,8 +10,12 @@ the [document return](evidence/2026-11-05-vergabe-document-return.json). The
 document UI still needs user review. File hash equality and signed-out download
 refusal are unverified. The user also confirms the **LOKAL** issue badge is
 visible in both accounts; the [issue return](evidence/2026-11-05-vergabe-local-issue-return.json)
-binds Ausschreibung 1, task 1 and document 1 from their supplied URLs. Task
-edits, domain approval/submission and recovery remain pending.
+binds Ausschreibung 1, task 1 and document 1 from their supplied URLs. The user
+now confirms cross-account task editing and the flow through documented
+**Zuschlag/Nachlese**, with further UI work needed; see the
+[functional-flow return](evidence/2026-11-05-vergabe-functional-flow-return.json).
+The functional walkthrough is confirmed with UI follow-up. The instructions
+below remain the reproduction sequence for the populated restart/restore drill.
 
 The other session does not update automatically, and a fresh login was needed
 after a short interval. The user wants a full working day without renewed login
@@ -107,8 +111,8 @@ and [deployment binding](vergabe-demo-company-binding.md). Its receipt must cove
 
 Existing database-only backup/restore targets default to historical `vergabe_db`
 and omit both file stores. They cannot establish this three-store recovery claim.
-Two-account sign-in and cross-account visibility of newly created records are
-user-confirmed; the remaining shared workflow is pending. The attended restart,
+The two-account functional walkthrough is user-confirmed with UI follow-up.
+The attended restart,
 off-host capture, isolated restore and rollback action has not been prepared or executed.
 Logged-in account deactivation remains a separate owner-run access-control check
 from the pilot contract. No account is disabled as part of these walkthrough steps.