Preserve writable OIDC fields on the loopback callback update.

The second attended attempt spawned the owner command, then failed closed.
Stop posting the entire role read-back and requiring exact dict equality.
Write a metadata receipt so the next failure has a class, not silence.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

workplans/RPF-WP-0025-openbao-operator-only-access.md

@@ -121,3 +121,13 @@ the session was revoked and private storage cleaned. No role write, Ingress
 change, or retained helper. Retry only through
 `python3 scripts/openbao-attended-exec.py --` and the absolute owner command.
 Do not reuse the failed relative-path attempt as callback evidence.
+
+A second attended attempt used the absolute owner command. Login reached a
+helper-backed session and the child started, then Warden reported
+`attended command failed closed because it returned a failure or unexpected
+output; the login session was revoked`. That string means the silent helper
+exited non-zero. The helper previously posted the entire role read-back and
+required exact dict equality; that path was never live-proven and can fail on
+read-only/normalized fields. No retained helper. Retry uses the same envelope
+with `--receipt` and a field-preserving write. Do not retract Ingress from this
+failed attempt.