diff --git a/ansible/inventory/host_vars/Railiance01.yml b/ansible/inventory/host_vars/Railiance01.yml
index f5c0cf7..42230e4 100644
--- a/ansible/inventory/host_vars/Railiance01.yml
+++ b/ansible/inventory/host_vars/Railiance01.yml
@@ -1,5 +1,10 @@
 # RCLK-WP-0005 / RAIL-HO-WP-0013: scoped operator-requested host baseline.
 railiance_clock_enabled: true
 railiance_clock_manage_timesyncd: true
-railiance_clock_authority_enabled: false
-railiance_clock_admission_ref: operator-clock-infrastructure-request-2026-09-15
+railiance_clock_authority_enabled: true
+railiance_clock_admission_ref: CCR-2026-0028
+
+# Artifact wheelhouse is supplied by the deployment controller; exact wheel is pinned.
+railiance_clock_key_preinstalled: true
+railiance_clock_wheel_sha256: 89d1419f038eff485a27a4206a19101ce7ca2976092971bbc796a77188fc93ad
+railiance_clock_kid: railiance01-clock-20260915-v1
diff --git a/ansible/roles/railiance_clock/tasks/authority.yaml b/ansible/roles/railiance_clock/tasks/authority.yaml
index f0afa59..9a57519 100644
--- a/ansible/roles/railiance_clock/tasks/authority.yaml
+++ b/ansible/roles/railiance_clock/tasks/authority.yaml
@@ -99,6 +99,7 @@
 - name: Load changed units before starting
   ansible.builtin.meta: flush_handlers
 - name: Export current host health
+  changed_when: false  # Refresh observation; no desired-state configuration changes.
   ansible.builtin.systemd:
     name: railiance-clock-health.service
     state: started
diff --git a/ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2 b/ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2
index 414215e..02ef340 100644
--- a/ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2
+++ b/ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2
@@ -12,7 +12,9 @@ ProtectSystem=strict
 ReadWritePaths={{ railiance_clock_health_root }}
 ProtectHome=yes
 PrivateTmp=yes
-ProtectClock=yes
+# adjtimex(modes=0) is read-only but ProtectClock blocks the syscall entirely.
+# Empty capability sets still deny clock writes, including nonzero adjtimex modes.
+ProtectClock=no
 RestrictAddressFamilies=AF_UNIX
 TimeoutStartSec=12
 UMask=0022
diff --git a/workplans/RAIL-HO-WP-0013-host-time-baseline.md b/workplans/RAIL-HO-WP-0013-host-time-baseline.md
index 542f845..4eafd8d 100644
--- a/workplans/RAIL-HO-WP-0013-host-time-baseline.md
+++ b/workplans/RAIL-HO-WP-0013-host-time-baseline.md
@@ -9,7 +9,7 @@ flavor: planning
 owner: codex
 topic_slug: railiance
 created: "2026-09-14"
-updated: "2026-09-14"
+updated: "2026-09-15"
 related_workplans:
   - RCLK-WP-0005
   - RCLK-WP-0002
@@ -81,7 +81,7 @@ A mocked systemctl result or container-only check is not host synchronization pr
 
 ```task
 id: RAIL-HO-WP-0013-T04
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "9adae3a6-8ee6-538b-9bb3-1ee32ed185e1"
 ```
@@ -99,3 +99,15 @@ railiance_clock owner role and host-time playbook; bootstrap invokes the same
 role. Authority activation requires artifact hash, admission reference and
 explicit signing-key delivery. Defaults change no clocks and deploy no service.
 Native convergence, custody and measured UTC policy acceptance remain open.
+
+## Live deployment — 2026-09-15
+
+CCR-2026-0028 authorizes the systemd authority and attended host-file custody.
+The role now prepares identity independently of key delivery, supports a verified
+preinstalled key, and pins the production wheel in Railiance01 inventory.
+The authority and health timer are active/enabled on loopback 8787. Readiness
+and signed workstation acceptance passed; receipt is in railiance-clock and
+railiance-platform docs/evidence/2026-09-15-railiance-clock-production.json.
+Health collection needs read-only adjtimex; ProtectClock is disabled only on
+that exporter, while both services retain empty capability sets. Disposable
+outage/reboot/rollback rehearsals remain tracked in T03.