Fix rotation review evidence and reconcile blocked S1 workplans

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3b9-b19e-7ba1-9eb4-4faea76af3ea

workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Make the S1 declaration reproducible and the handoff verifiably green"
 domain: financials
 repo: railiance-infra
-status: active
+status: blocked
 flavor: implementation
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-08-23"
+updated: "2026-09-27"
 related:
   - RAIL-HO-WP-0002
   - RAIL-HO-WP-0009
@@ -313,3 +313,27 @@ Current evidence (2026-08-23):
 - Forgejo Actions run 79 is green for revision `4f2312a` across all three jobs.
 - Pending before finish: an attended fresh all-host handoff receipt and an
   attended non-printing SOPS decryption receipt.
+
+## Closeout review — 2026-09-27
+
+T08 source gaps repaired: the default metadata-only output now includes exact
+file paths, ciphertext hashes and before/after recipient sets; approval binds
+the ciphertext hash; applied receipts preserve the reviewed original recipients
+and hash alongside the resulting hash. Three regression tests cover these cases.
+Unrelated Make targets no longer decrypt the provider token or read/export the
+private age key during Makefile evaluation. No credential was rotated.
+
+T05 remains `wait`: a read-only Ansible 2.17.13 run reached both hosts with
+`changed=0`. CoulombCore lacks `/usr/local/bin/goss`; Railiance01's installed
+baseline checksum differs from the source-rendered profile. The next step is a
+reviewed Goss refresh for each host, followed by remediation of any actual
+baseline failures and a clean-revision all-host handoff. A failed surface check
+is not green host evidence. See `docs/evidence/2026-09-27-loose-ends.md`.
+
+T08 remains `wait`: source tests and metadata checks pass, but this workstation
+has no SOPS executable or approved decryption session for the repository's
+recipient. The existing attended non-printing decryption receipt is still
+required; mock tests do not substitute for it. The host having SOPS installed
+does not establish approved recovery-key custody.
+
+Workplan is `blocked` until those live verification prerequisites are met.