Fix rotation review evidence and reconcile blocked S1 workplans

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3b9-b19e-7ba1-9eb4-4faea76af3ea

workplans/RAIL-HO-WP-0013-host-time-baseline.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Declare and verify the Railiance host UTC baseline"
 domain: financials
 repo: railiance-infra
-status: active
+status: blocked
 flavor: planning
 owner: codex
 topic_slug: railiance
 created: "2026-09-14"
-updated: "2026-09-15"
+updated: "2026-09-27"
 related_workplans:
   - RCLK-WP-0005
   - RCLK-WP-0002
@@ -33,7 +33,7 @@ and tools/observe_host_clock.py. No configuration or clock change was made.
 
 ```task
 id: RAIL-HO-WP-0013-T01
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "9e5db140-0642-58de-8a9c-1c5a3cfd7b6e"
 ```
@@ -49,7 +49,7 @@ Define what source health can honestly claim before exposing it to the clock app
 
 ```task
 id: RAIL-HO-WP-0013-T02
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "75f17ffa-b781-549d-82ce-d19d431c2618"
 ```
@@ -81,7 +81,7 @@ A mocked systemctl result or container-only check is not host synchronization pr
 
 ```task
 id: RAIL-HO-WP-0013-T04
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "9adae3a6-8ee6-538b-9bb3-1ee32ed185e1"
 ```
@@ -111,3 +111,30 @@ railiance-platform docs/evidence/2026-09-15-railiance-clock-production.json.
 Health collection needs read-only adjtimex; ProtectClock is disabled only on
 that exporter, while both services retain empty capability sets. Disposable
 outage/reboot/rollback rehearsals remain tracked in T03.
+
+## Closeout review — 2026-09-27
+
+All four residual tasks are `wait`; deployed source alone does not meet their
+acceptance criteria. T01 is blocked on RCLK-WP-0002 source/leap/error-model
+acceptance; that owner's T01–T03 are still in progress and T04 is todo. T02 has
+an implemented opt-in role and passes native Ansible syntax checking, but still
+requires T01's reviewed policy and baseline/Goss health integration. T03 requires
+an admitted disposable Ubuntu VM for convergence/no-op, drift, reboot,
+source-outage/recovery and rollback evidence. No such test target is declared in
+this repository. T04's prior live deployment evidence stands, but its required
+T03 recovery evidence and steady-state handoff remain outstanding.
+
+Refreshed read-only inventory:
+`docs/evidence/2026-09-27-railiance01-clock-inventory.json`, collected with the
+existing railiance-clock collector. Installed systemd and systemd-timesyncd:
+`255.4-1ubuntu8.17`. Effective system/fallback source: `ntp.ubuntu.com`;
+per-link and runtime source lists empty. Poll bounds 32–64 seconds, root-distance
+threshold 500ms, observed leap 0. UTC, timesyncd active, synchronization reported,
+no UDP/123 listener and no observed competing daemon. These are diagnostics,
+not independent accuracy or source-independence proof. Configuration hashes are
+in the receipt; no host configuration was changed.
+
+The September 14 duplicate-workplan inbox warning is historical: the current
+checkout has one WP-0013 file and already contains consolidation commit
+`c402245`. Preserve its existing task UUIDs. Workplan is `blocked` on the
+remaining review and native recovery prerequisites.