diff --git a/docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json b/docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json
new file mode 100644
index 0000000..ce51cce
--- /dev/null
+++ b/docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json
@@ -0,0 +1,27 @@
+{
+  "task": "RPF-WP-0043-T03",
+  "collected_at": "2026-10-11T19:05Z",
+  "collected_by": "claude-code (agt-claude-railiance01 via k3s-api-railiance01 tunnel), read-only",
+  "cluster_node": "239.62.205.92.host.secureserver.net (railiance01)",
+  "step1_helm": {
+    "release": "policy-nexus", "namespace": "policy-nexus", "chart": "policy-nexus-0.2.0",
+    "deployed_revision": 9, "deployed_at": "2026-10-11T01:23:33",
+    "rollback_target_revision": 9,
+    "image_repository": "forgejo.coulomb.social/coulomb/policy-nexus",
+    "image_digest": "sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
+    "publicationManifestDigest": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
+    "sourceInventoryDigest": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
+    "sourceSetDigest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256"
+  },
+  "step2_render_diff": {
+    "status": "not-run",
+    "reason": "railiance-apps values path/revision not yet supplied (RAPP-POLICY-NEXUS-WP-0002-T02)"
+  },
+  "step3_objects": {
+    "listed_kinds": ["Deployment", "Service", "ConfigMap", "Ingress", "NetworkPolicy", "ServiceAccount", "PersistentVolumeClaim"],
+    "objects": ["Deployment/policy-nexus", "Service/policy-nexus", "ConfigMap/kube-root-ca.crt", "Ingress/policy-nexus-http", "Ingress/policy-nexus-https", "NetworkPolicy/policy-nexus-acme-solver", "NetworkPolicy/policy-nexus-default-deny", "NetworkPolicy/policy-nexus-traefik", "ServiceAccount/default", "ServiceAccount/policy-nexus"],
+    "argocd_tracking_label_or_annotation_present": false,
+    "secrets": "not listed (agent guard forbids Secret reads); Helm release Secrets carry no ArgoCD tracking label by construction",
+    "stop_conditions_hit": false
+  }
+}
diff --git a/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md b/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md
index ea6c71e..79fbb80 100644
--- a/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md
+++ b/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md
@@ -134,13 +134,15 @@ are placeholders and must be filled from the attended read.
 ```task
 id: RPF-WP-0043-T03
 status: wait
-needs_human: true
 decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
-blocking_reason: "Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster."
+blocking_reason: "Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel."
 priority: high
+depends_on: [RAPP-POLICY-NEXUS-WP-0002-T02]
 state_hub_task_id: "2afb1aac-66dd-5e1e-92e1-fc020a59a927"
 ```
 
+2026-10-11: read-only checks are agent-runnable (k3s-api-railiance01 tunnel); no longer an attended item.
+
 Draft the Application under `docs/`, **not** under `argocd/applications/` on
 `main`. The single-source sketch is superseded by the tenant's multi-source
 shape. The draft is `docs/drafts/policy-nexus-application.yaml`: chart
diff --git a/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md b/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
index 38a71c1..e6c140c 100644
--- a/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
+++ b/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
@@ -347,7 +347,7 @@ id: RPF-WP-0044-T08
 status: wait
 needs_human: true
 decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
-blocking_reason: "Operator read-only check of coulombcore ArgoCD; item on the attended-window checklist (D1 standing rule), not a decision."
+blocking_reason: "Founder runs read-only: ssh coulombcore 'sudo k3s kubectl get applications -n argocd' (agent identity has no kube rights on coulombcore)."
 priority: low
 state_hub_task_id: "55d1382f-5862-5321-a1c9-96767764ba43"
 ```