Finish hub-core credential lane workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

docs/evidence/core-hub-private-shadow-2026-08-21.md

@@ -74,6 +74,24 @@ value is included in this record.
   and operator-authenticated protected reads/writes. Its temporary token file
   was mode 0600 and shredded on exit.
 
+## Scheduled rotation stabilization observation
+
+- At `2026-08-21T22:23:39Z`, after more than six hours of live stabilization,
+  both five-minute hub-core database ExternalSecrets completed another
+  scheduled reconciliation with `Ready=True` / `SecretSynced`.
+- The runtime target Secret resourceVersion advanced from `50635316` to
+  `50636878`; the migration target advanced from `50635319` to `50636875`.
+  Only metadata was observed; neither Secret data nor a credential value was
+  read or logged.
+- After projected-volume propagation, the candidate application child PID
+  changed from `224` to `278`. The pod UID remained
+  `64bfd630-4f9c-4df8-9939-c737bd5c5a8a`, readiness remained true, and its
+  container restart count remained zero. The
+  `openbao-core-hub-database` ClusterSecretStore remained `Ready=True` /
+  `Valid`.
+- This closes the deliberate scheduled-rotation stabilization gate in
+  `RAILIANCE-WP-0023-T02` without forcing a refresh or disrupting the pod.
+
 `CCR-2026-0013` is verified. Public promotion, final write freeze/transfer,
 DNS changes, and CoulombCore retirement remain separate operator gates under
 `CORE-WP-0011`.