diff --git a/findings/RISK-F-0015-emergent-claude-owner-routing.md b/findings/RISK-F-0015-emergent-claude-owner-routing.md
index 2146101..c3792da 100644
--- a/findings/RISK-F-0015-emergent-claude-owner-routing.md
+++ b/findings/RISK-F-0015-emergent-claude-owner-routing.md
@@ -294,3 +294,42 @@ The route evidence named in the closure condition is now present for the
 full current-release corpus. `EMERGENT-WP-0002-T07` has not accepted it and
 is still `wait`. Severity stays low `I1` × `L3`. Disclosure stays `public`.
 Escalation stays `none`.
+
+## Observation — 2026-10-04: Whitehat disposition of sealed knowledge 0.2.6
+
+Recorded from unread State Hub message
+`5c6dd4c3-ae0d-4740-b4aa-f1abe18ab832`, from `whitehat-security`; this is
+the requested copy, not earlier delivery `9d15a165-ba88-41a1-8160-77b79fd4994c`.
+Risk-nexus also read the reporter's committed record at
+`whitehat-security/evidence/2026-10-04-emergent-026-offline-review.md`,
+commit `db32a4174f71ca57a7ca73ad27a0a71609f0cb06`, work record
+`WHITEHAT-WP-0010`.
+
+The reviewed package is sealed knowledge 0.2.6, digest
+`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`,
+package commit `f65d0e64bc710eafb1dac4dd64b05516493d8c31`; corpus commit
+`f542a91deb003feb7fad3ecc17504c514a7c5479`.
+
+Whitehat reports that the recorded Codex, Claude, and Grok answers do not
+recommend an unsafe effect. In all three, `zones` routes to `zone-engine`
+and `model-switch` routes to `session-owner`, with `glas-harness` in the
+model-switch sources. The filed 0.2.1 Claude misses are not repeated.
+Seventeen fixture route tokens match in each session. The other eleven
+per provider remain ungraded; this observation assigns no grade to them
+and makes no severity ruling.
+
+The evidence limits remain: Codex has no exact server model, and the run
+is not a governed harness session. Whitehat's 2026-10-04 source check left
+`informed-decision` changed: sealed pin
+`b4f637326ba3c2526f4648c4c90544948408d53f`, clean sibling HEAD
+`b65363527e41a76140a3967fe5e84ef5fc2f190b`. Whitehat did not re-pin;
+this register observation does not re-pin or renew the launch-time source
+validation. Whitehat's library probes passed 9/9 and did not reproduce
+WH-KNOW-001 or WH-KNOW-002. That bounded pass means only that the attempted
+attacks did not work; it is not provider acceptance.
+
+RISK-F-0015 remains `open` and `public`. Closure remains
+`EMERGENT-WP-0002-T07` accepting complete current-release provider evidence
+resolving both routes. The Whitehat message and disposition are not that
+acceptance; Whitehat does not call the evidence complete for T07. This is
+an observation only, not a grading or a complete register check.