Close verified incident task and finish local workplan loose ends

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3c3-621b-7350-9f77-50a8d3ee7657

docs/net-kingdom-credential-custody-contract.md

@@ -3,8 +3,8 @@
 Historical resolver lanes: **draft / blocked**.
 KeyCape factor service lane: **active**, established and verified 2026-09-13 (below).
 Incident: `KEYCAPE-EXPOSURE-20260823-01`
-Consumer procedure: NetKingdom `NK-WP-0033`, resolver reconciliation revision
-`eec7007` / checkout `f2e578c`
+Consumer procedure: NetKingdom `NK-WP-0033`; latest attended check used
+checkout `6096c395` (script `4a38511`) on 2026-09-23.
 
 This document defines the Railiance-side contract without containing or
 deriving any credential value. It is not an authorization to fetch, export,
@@ -49,6 +49,17 @@ Operator decision 2026-09-15: leave both historical resolver lanes blocked.
 Do not invent mount, path, or field names. The KeyCape factor service lane
 below is separate and does not close this gate.
 
+September 27 evidence review: NetKingdom's September 23 operator ruling and
+green attended `--check --predecessor-unavailable` receipt close the incident
+verification obligation (RPF-WP-0027-T05). The predecessor remains NOT-PROVEN;
+the operator explicitly accepted its unavailable disposition. The owner records
+human custody at `operators/lldap/admin` and `operators/privacyidea/pi-admin`,
+including KV v2 LLDAP version 1 and withheld delete under `operator-custody`.
+These are confirmed owner coordinates, but they do not by themselves establish
+either historical route's complete field, auth, expiry and handoff contract.
+T03/T06 and the non-resolvable historical routes therefore remain blocked.
+See `docs/evidence/2026-09-27-keycape-incident-owner-return.json`.
+
 ## KeyCape factor service lane — authorized setup, 2026-09-13
 
 RPF-WP-0040 / CCR-2026-0023 establish a new dedicated service lane. The user,