diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/dirty-workplan-refinement.json b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/dirty-workplan-refinement.json
new file mode 100644
index 00000000..fc7385bd
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/dirty-workplan-refinement.json
@@ -0,0 +1,8 @@
+{
+  "original_refusal": "pending_commit: authoritative workplan files have uncommitted changes",
+  "pending_original_commit_retained": "518369dbee08b7f7690ee70d0cbc405ea4158397",
+  "notes_commit": "1513dad6528ab766a7631e88d9c04be4bc605f42",
+  "resolution": "Commit the authoritative workplan notes before projection. Later batches contain evidence only. Normal hooks, push and primary projection unchanged.",
+  "original_dirty_paths_preserved": 8,
+  "native_actions": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/metadata-reconstruction-failure.json b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/metadata-reconstruction-failure.json
new file mode 100644
index 00000000..bcc5aa68
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/metadata-reconstruction-failure.json
@@ -0,0 +1,5 @@
+{
+  "original_generic_check": "3 of4 passed; KEY39 original already contained typed SHA256 strings, so stripping every prefix failed original hash equality. No files were materialized.",
+  "correction": "Explicit per-record introduced-prefix inventory; existing typed SHA256 receipt fields are preserved.",
+  "source_or_frozen_original_bytes_changed": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-refinement.json b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-refinement.json
new file mode 100644
index 00000000..825c0718
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-refinement.json
@@ -0,0 +1,63 @@
+{
+  "hook_refusal_blob": "8bde861b20c82729cb6dc18785878726ecc5a437",
+  "hook_refusals_before_correction": 2,
+  "normalizer_preflight_failure": "Expected32 but actual33 public entries; stopped before writes. Unchanged retry reproduced same hook refusal; no commit.",
+  "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json",
+  "public_file_digests_verified": 33,
+  "original_sha256": "sha256:daba4249aeb0563e069cd9c06bd3c80442e2f3ed0f028943bdf8a8355321f74d",
+  "published_sha256": "sha256:9afff88e80c110d86f8f808657c179938f21ae6f8d32f05f8d605d65cfc117f2",
+  "derivation": "Only exact public file-digest values changed from bare hex to typed sha256 notation. Strip prefix from each value and JSON-dump indent2 plus newline to reconstruct byte-exact frozen original.",
+  "byte_exact_original_reconstructed": true,
+  "source_patch_chart_code_or_policy_changed": false,
+  "scanner_rules_or_allowlists_changed": false,
+  "additional_metadata_derivatives": [
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-inventory.json",
+      "blocked_blob": "979618bf97d533c02e25f6e985406f84131afc23",
+      "original_sha256": "sha256:77aabbe413aae6ac31c342304afa200d09ff3c74e3fc9f18d2af6919a816ab94",
+      "published_sha256": "sha256:866641169b73aa6e56d4f8f3d497eda28229bdf2aafe98daf5fefd09258338a1",
+      "public_chart_archive_verified": true,
+      "byte_exact_original_reconstructed": true,
+      "original_frozen_SHA256SUMS_entry_retained": true,
+      "additional_public_commit_notation": {
+        "field": "key_cape_head",
+        "value": "git:d803e9282a47b49daf930fb905312fa5104c0ace",
+        "verified_current_public_source_commit": true,
+        "redacted_rule_line": "generic-api-key line4",
+        "scanner_sha256": "sha256:88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509"
+      },
+      "reconstruction_prefixes": [
+        "sha256",
+        "git"
+      ]
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/source-pins.json",
+      "blocked_blob": "488fc07767ba47aad0bf347d1ff5901f75c32505",
+      "original_sha256": "sha256:e308fc2ced7825ae72449ee549cb57fc43eb2842bfac95a79806e4e0b81bdfe3",
+      "published_sha256": "sha256:c148d950ab1b45479a401aa9c45813793a6575af05694c40f39d35fc2b5db5dc",
+      "public_file_hashes_verified": 19,
+      "frozen_public_source_commit_verified": true,
+      "byte_exact_original_reconstructed": true,
+      "reconstruction_prefixes": [
+        "sha256",
+        "git"
+      ]
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-current-r2/verification.json",
+      "blocked_blob": "12c9cad71d6ed6d5f85fb58b069bd6f6733d56e4",
+      "original_sha256": "sha256:1cc5df585559803f83baf337dfdef979ef8c5927d6cd2dcf30de1a574586462b",
+      "published_sha256": "sha256:b396b22507031a366403be525d1d79892d82283414e7bd5a9365d70db85e5ac2",
+      "public_keycape_commit_verified": true,
+      "byte_exact_original_reconstructed": true,
+      "reconstruction_prefixes": [
+        "git"
+      ]
+    }
+  ],
+  "reconstruction_for_all_metadata": "Strip ONLY each record's declared newly introduced prefix(es) from complete digest/commit strings, then JSON dump indent2 plus newline. Preserve prefix strings already present in the original receipt. Every reconstructed original must match its recorded SHA256.",
+  "reconstruction_prefixes": [
+    "sha256"
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publication-refinement.json b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publication-refinement.json
new file mode 100644
index 00000000..1c934990
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publication-refinement.json
@@ -0,0 +1,7 @@
+{
+  "failed_stage": "first git add refused four explicitly selected ignored synthetic review logs; no commit created",
+  "head_unchanged": "05df7c3ee4d31879e7e0074e3210656b4f795794",
+  "change": "Force-add only the existing explicit public source/evidence path list, retaining normal scanner/commit/server hooks. No ignore or scanner rule changed.",
+  "original_publisher_sha256": "sha256:cf44080058cea7a50fd370c5bb751d580f07a7c1238b10fb26ddfc66887004f2",
+  "executed_publisher_sha256": "sha256:cca499787938ba30cf371d566697b97a7618dc4c49c49682d90b5420b5914b4e"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publication-summary.json b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publication-summary.json
new file mode 100644
index 00000000..9d557be0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publication-summary.json
@@ -0,0 +1,443 @@
+{
+  "status": "source_evidence_published",
+  "root_commit": "git:90490002c16d353d675f4295f395d1917d30b9ef",
+  "source_files": 96,
+  "normal_commits": [
+    {
+      "commit": "git:518369dbee08b7f7690ee70d0cbc405ea4158397",
+      "files": 18
+    },
+    {
+      "commit": "git:1513dad6528ab766a7631e88d9c04be4bc605f42",
+      "files": 2
+    },
+    {
+      "commit": "git:6548540fd46c7fcd365f399516a5d36e38d1e7fd",
+      "files": 18
+    },
+    {
+      "commit": "git:14670441cd567621ca86e466b113944ec8363798",
+      "files": 18
+    },
+    {
+      "commit": "git:11a485f1dd9267cc63f9beb0436aa17c0d3317cb",
+      "files": 8
+    },
+    {
+      "commit": "git:31f5cbf7b52c909ceebfdfc39ef0100908f63d5b",
+      "files": 1
+    },
+    {
+      "commit": "git:0caed1f5300c1f5a6ededcca7948b120a126b85d",
+      "files": 18
+    },
+    {
+      "commit": "git:90490002c16d353d675f4295f395d1917d30b9ef",
+      "files": 13
+    }
+  ],
+  "original_dirty_worktree_and_index_paths_preserved": 8,
+  "scanner_policy_or_allowlist_changes": false,
+  "historical_public_metadata": "See public-digest-refinement.json and reconstruct_public_metadata.py for byte-exact frozen originals.",
+  "native_gates_closed": 0,
+  "goal_status": "active",
+  "files": [
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/README.md",
+      "sha256": "sha256:fb652cd9c77ae0f270f7775a17e01bc57498db52df40dd867028e0ecc3957cc5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/SHA256SUMS",
+      "sha256": "sha256:9cb1c3e6d70595b140dfa65f57d8883667be81cc4e84371426412bb38c9a4716"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/baseline-reproduction.log",
+      "sha256": "sha256:abcec396aee21d9f44dd949b3de58e91ff4c15452af62dc168354c7f5769dca2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/candidate/credential-grants/catalog.yaml",
+      "sha256": "sha256:7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/candidate/scripts/keycape_client_secret_generate.py",
+      "sha256": "sha256:da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/candidate/tests/test_credential_grants.py",
+      "sha256": "sha256:5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/candidate/tests/test_keycape_client_secret_generate.py",
+      "sha256": "sha256:5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/manifest.json",
+      "sha256": "sha256:61c15ae8d12b3665eb0e210cc0a1b0a238f52026258a59987657fd77f8d6c0ba"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/patch-check.log",
+      "sha256": "sha256:3ecccb9cee2279b2f6d665fc7116421685262abbd7b0f82f59e3c8ed56892ba3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/platform-source.patch",
+      "sha256": "sha256:b0b85153d04a28d4bb05ab39a9b54c782c9efa54bd80ca961e2bcc6348a9b546"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/reproduce-baseline.py",
+      "sha256": "sha256:f3d1feabe5124f882306b1b58485a86ac2072d93981d468dc746efdf4ed6b6b3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/run-tests.sh",
+      "sha256": "sha256:28f077918a87437d76b14dc93a035b358a99f1a721735b189263cf6d3b27fdea"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/tests.log",
+      "sha256": "sha256:2102b703320a633de8a5135a753020d4e8e0854947df41f400b2935562f38191"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-followthrough-r1/workplan-source-draft.md",
+      "sha256": "sha256:88e329cb244818427717b9f28b26b2ef2610c20f6ad3dfd3ae0d83386b6c1b51"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/baseline-reproduction.log",
+      "sha256": "sha256:f27db22e006f6272b60d8a581ecedfc2b5096703dc99504eada23a372be6a119"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/independent-probes.py",
+      "sha256": "sha256:11b071b919a2da098ad6f20a89f93aadc55a9c08f731d46f2196f63ebd427f79"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/review.json",
+      "sha256": "sha256:05d5bf9c2b90a8562ce4675866b8b23c0e12d5d069b43b194948d384b0a553f5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/apply_source.py",
+      "sha256": "sha256:70ae712d14ad2f21456b98fab2d92ab5736dfae72afd817382f811b9c5823c50"
+    },
+    {
+      "path": "docs/netkingdom-target-implementation.md",
+      "sha256": "sha256:274109882a4b31163869bccccdc12e51a3c647d5f39fe549c5d4c7aac62e0fe2"
+    },
+    {
+      "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
+      "sha256": "sha256:f76417b96a7e7ed0c60394d18a0d0b9305d6320248f67b58ac86e439cb76e343"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.json",
+      "sha256": "sha256:39ffa437ed22fa879e6e267a7bec9ba250d6af66135e341ac75cbb7babe546e2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.stderr.txt",
+      "sha256": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-assignment.json",
+      "sha256": "sha256:f6c200a95e24d233710d5025dbc3a45332ea8131c90bb3f29ba32947fc0e5d73"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-preview.json",
+      "sha256": "sha256:5c83d1397d2ec4c8bf7b98d38104f06adbda6c5ce9019ed62e62338fb828094b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.json",
+      "sha256": "sha256:e5a68f6d05a95025b4822a0ca4754e1ed99c8e8a59956251ab1264c6509e2aa3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.stderr.txt",
+      "sha256": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-commit.json",
+      "sha256": "sha256:c0080b63d652d428b05a48ec031b63c80903a863879988eecc35ce2802836afa"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-inputs.json",
+      "sha256": "sha256:1b8b686ab3e8fc97dff7e1b7fbc5eb42fca49475103429e90f951f5934b6994e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/source-application.json",
+      "sha256": "sha256:1e856a3809badba3f2bc4df075730734c4743356f0bd17d98367a309177b5320"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/verified-task-bindings.json",
+      "sha256": "sha256:6312afc4c4de6f9f37444bba305c62ca19ef956f92e3198f15c755841131205c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/workplan.md",
+      "sha256": "sha256:1336a513130c9751d73a9d696d38fb6377e85c6cc107c2968431abfd2e8fd762"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/OWNER-CHANGE.md",
+      "sha256": "sha256:f58e6e3aafec79436c4735387e6a6d4e8302107e9ca7a27bec37b2d65cbd1d50"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/README.md",
+      "sha256": "sha256:3df15baabe3a0d41397568a6b181a204d6aadd3d63ab7f2b3495589dd8768924"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json",
+      "sha256": "sha256:9afff88e80c110d86f8f808657c179938f21ae6f8d32f05f8d605d65cfc117f2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/apps-source.patch",
+      "sha256": "sha256:85be01b5d370e7996e8a2b18c4d7b576a24b0ca6d1c03454157091c581f20a01"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-registry-values.yaml",
+      "sha256": "sha256:a38f551734843c6367448f267c7376b1aeee010927a49690fdd7c1471e0ae450"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-values.yaml",
+      "sha256": "sha256:9467ef8d28de53496cf6f7b71c3b9669cd9ce91ef0667342b6aba457d05d424c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-registry-values.yaml",
+      "sha256": "sha256:a38f551734843c6367448f267c7376b1aeee010927a49690fdd7c1471e0ae450"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-values.yaml",
+      "sha256": "sha256:cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-inventory.json",
+      "sha256": "sha256:866641169b73aa6e56d4f8f3d497eda28229bdf2aafe98daf5fefd09258338a1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/consumer-delivery.yaml",
+      "sha256": "sha256:56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/forgejo-case-1.3.yaml",
+      "sha256": "sha256:546aad5cf26842c484fc6ba99940d56697b85531afea11872556761008923c94"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/AGENTS.md",
+      "sha256": "sha256:77c8e1ac762e7c101cd09a3aa184993309ed057821bd53fb0d318979a45c9315"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/INTENT.md",
+      "sha256": "sha256:b22cb440691bb399b064ee10ab1a03e1e07838da1051bf6235fbfe2cf820eb10"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/src/cmd/keycape/main.go",
+      "sha256": "sha256:ff1ee4f5d2eb86a1e4184374d5244e24704d9d5fd780e173062af07112344afd"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/src/internal/config/config.go",
+      "sha256": "sha256:afd465acd9b6879493b888acc6fc54b9a71e032892701a81f1072986d2c30ac7"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/src/internal/domain/model.go",
+      "sha256": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/src/internal/server/oidc/token.go",
+      "sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/key-cape/src/internal/server/oidc/userinfo.go",
+      "sha256": "sha256:bbd5fa9ebd0726371c90d6938536c1ce5fcfacbbe853a80833e3587fc2115a0b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/source-pins/type-1.3.yaml",
+      "sha256": "sha256:ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/test-output.txt",
+      "sha256": "sha256:64171812c2935ab8616e17c69b6fcfcbfb2ffc411edb1b7a8ff786a936eb63f0"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/tests/test_forgejo_chart_projection.py",
+      "sha256": "sha256:3aae2236ffcefbeed9225a9bf35650f1128379004ab6e34d548a596192824156"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/tools/forgejo_chart_projection.py",
+      "sha256": "sha256:b4900a9dbb98847ab81a723eddde1fbf0ea39c2fabc7d7006a1debd811b8a553"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/chart-12.5.0/Chart.yaml",
+      "sha256": "sha256:60e8522a68c67c0b18bdb9fb66b27a19ad09f8a051ee3757ade5de1d3f299224"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/chart-12.5.0/templates/_helpers.tpl",
+      "sha256": "sha256:792273fd24f4e8cf5328391fc3f5f1e406e24fe78ac4925c88d61426daccc6fb"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/chart-12.5.0/templates/gitea/deployment.yaml",
+      "sha256": "sha256:1abdd4e7915f392aca91073003887bf75baf1f0e5b66928a2f4c4a140dbeba0e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/chart-12.5.0/templates/gitea/init.yaml",
+      "sha256": "sha256:518c78409b35d4612c413d9ff66c21ced32f8fbeb4b704950ff5ab1b919220bc"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/chart-12.5.0/values.yaml",
+      "sha256": "sha256:acdcea4c5739152b7fd825202b3920cfa22040d4b82d8e20588163ba3821abf3"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/chart-index-entry.json",
+      "sha256": "sha256:bb5ea7f46836ded497662ef380c2cd146e34b76cea72085051dfe08f218bcbe5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/forgejo-v11.0.3/cmd/admin_auth_oauth.go",
+      "sha256": "sha256:d5faee30ffbb9a560256c92a0e05e652b79e95e016448cbac7dbb6ad0fdad937"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/forgejo-v11.0.3/routers/web/auth/oauth.go",
+      "sha256": "sha256:6f454b3550b150178a8597a9437adb0c626556f34c15a13778c15d675b05659b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/forgejo-v11.0.3/services/auth/source/oauth2/source.go",
+      "sha256": "sha256:a6ee5146c07d8efb1837ef91f1ab5f3139f69a1ff66f814d5e9c6053bf9b0d8b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/validation.json",
+      "sha256": "sha256:bca9146212d10c9f3cc68593623032a0e13c0dcb1e43b6117a81129a0e4308cd"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/README.md",
+      "sha256": "sha256:11e7d8d18d291f609ad98c4d2c033343005061d155a2f5c1ad3482d309e59653"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/clustersecretstore-v1-schema.json",
+      "sha256": "sha256:f74b1c186ed40fd7e4af47941fb5ec48e70e5fa66631ef1307e943b0773baf00"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/externalsecret-v1-schema.json",
+      "sha256": "sha256:22f69a2d2c64d1b4887766194b74e9543ec7b2e24f4696f9d7e0838b428ae2a7"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/independent-defect-reproductions.log",
+      "sha256": "sha256:6608fcaee88f89acf73b3a42fa0da4af42cfaca2c85426616c8103062fe3dbd6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/original-command-tests.log",
+      "sha256": "sha256:2d75ce8f96f7d410fa2cf82b695bbce0235449fefa81430de71c0291a1fe3af2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/original-contract-tests.log",
+      "sha256": "sha256:a60cbc658cabf862267757db7d303fa678e7a7ca4fe58aa2f2ba933e654451a7"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/partial-defaults-fix.patch",
+      "sha256": "sha256:1f2da9690e1c61871f7db8f885c90152cd7a68e392f5bcc62fcc8e0f408f8d4e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/partial-fix-source/scripts/keycape_issuer_delivery.py",
+      "sha256": "sha256:f740564866f2c71efc034eb1c4f844308a301499c2f67e7629a9f588a76cc84a"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/partial-fix-source/scripts/keycape_issuer_eso.py",
+      "sha256": "sha256:e0164a39c4a51ebbea66c38c2d42880675e242edb3920b2a2d362f365dee7c67"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/partial-fix-tests.log",
+      "sha256": "sha256:7cee0c9848167e8417202a0832de5e3ea72db2b36d83ac33a8df932711988f1b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/partial-patch-check.log",
+      "sha256": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/runs.json",
+      "sha256": "sha256:727665c0b005d01b3cd02ede816939d7a643d0fbe481ab05d90d1fce670a479a"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/source-pins.json",
+      "sha256": "sha256:c148d950ab1b45479a401aa9c45813793a6575af05694c40f39d35fc2b5db5dc"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/test_independent_review.py",
+      "sha256": "sha256:6caa6686b85e22461a2fdc1f9893fb11ed074540ebf62a18226f744a169f386e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-review-r1/test_partial_defaults_fix.py",
+      "sha256": "sha256:7c6489103a223a42fe8a31c8d54a38dd066f2ec38db5e18454309b6185c253c4"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/apply_refinement.py",
+      "sha256": "sha256:4d467786dd70b8073de8c62ff93930637a888573adb20babf52764bbd664ab58"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/consistency.json",
+      "sha256": "sha256:e6efe6659602921c5cac4d5074f80caf90d722e85235d9ee28fa914ac3e8a6ea"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/consistency.stderr.txt",
+      "sha256": "sha256:f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/identifier-assignment.json",
+      "sha256": "sha256:e531a5763f369c1d38ffc1bf07d6a5f8b05f14e4c4fd9551d91ae2448319f988"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/identifier-preview.json",
+      "sha256": "sha256:a4efdf6208f8c2fefac5044be55c97c27cee2110ff71d28d1991afcb6cda1d20"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/projection.json",
+      "sha256": "sha256:0c67c6d28d63732cfe59283cab0af7699486cc903bf4227756fcda0cc35e5de1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/projection.stderr.txt",
+      "sha256": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-commit.json",
+      "sha256": "sha256:af92f425052512de27404ae5d04691451261bfc2dd7d2c6018b3e65977aefdcd"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/publication-inputs.json",
+      "sha256": "sha256:07f73a93e7532a5a36147b284aa0b14f1c458f4452ff7ce74e8ec8cfdb31171b"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/source-refinement.json",
+      "sha256": "sha256:07352ce8be8512baaee6cfac4a9d61c19ee28d237238c3bdb3e80664aa18da97"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/task-additions.md",
+      "sha256": "sha256:2908828d7277b7e28b92c15b01c66e7ce04009a81807499c5dfd482410da9eaf"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/nk48-consumer-compatibility-r1/verified-task-bindings.json",
+      "sha256": "sha256:b3cbc9b2f4968cddb88ea9814a9d0da97bbf6921e7abe778a3dd16bec9d430d9"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-current-r2/progress-receipt.json",
+      "sha256": "sha256:b83912f0a378db692ba0cb6eb42a5d46b0b10b08e0939fd85c8f9253861852dc"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-current-r2/upstream-preparation.json",
+      "sha256": "sha256:541f5ffc7d4761b5e343cf35af7a9af3dfa5009707c075867dd3e191d6d01fc1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/key39-finalization-current-r2/verification.json",
+      "sha256": "sha256:b396b22507031a366403be525d1d79892d82283414e7bd5a9365d70db85e5ac2"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/publish.py",
+      "sha256": "sha256:519c136bfad6d602e44ee35522df68dea2aa8cdda65f1de62c36a5e13c942051"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/fetch_public_inputs.py",
+      "sha256": "sha256:a3077118f2dd4366b4fc38d554822b72c116aab99d6e978c75ce7fc56816c516"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/scope.json",
+      "sha256": "sha256:6d0b09dad0ffc9fb28bd2ebd200a668d41fe3f9ece56649689313f28887cf290"
+    }
+  ],
+  "current_source_exceptions": [
+    {
+      "path": "docs/netkingdom-target-implementation.md",
+      "sha256": "sha256:798093602f9c11d086af960b97a97f1a1d116962136e01de1b336df8a9603cec"
+    }
+  ],
+  "expected_owner_heads": {
+    "railiance-platform": "git:d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
+    "net-kingdom": "git:201e2fa0f9c8398187e60983782d4aea31da19ea",
+    "ops-warden": "git:b593c879831378db7dc62adfabdfedf2d44ddd38",
+    "railiance-apps": "git:944b30ad63ab054cc24617e374e177d34cd572da",
+    "key-cape": "git:d803e9282a47b49daf930fb905312fa5104c0ace"
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/reconstruct_public_metadata.py b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/reconstruct_public_metadata.py
new file mode 100644
index 00000000..1a570c6d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/reconstruct_public_metadata.py
@@ -0,0 +1,43 @@
+"""Verify/reconstruct frozen public metadata after typed digest publication."""
+from pathlib import Path
+import argparse
+import hashlib
+import json
+import re
+
+HERE = Path(__file__).resolve().parent
+ROOT = Path('/home/worsch/the-custodian')
+DATED = HERE.parent
+record = json.loads((HERE / 'public-digest-refinement.json').read_text())
+rows = [record, *record['additional_metadata_derivatives']]
+by_name = {str((ROOT / row['path']).relative_to(DATED)): row for row in rows}
+parser = argparse.ArgumentParser(__doc__)
+parser.add_argument('name', choices=sorted(by_name))
+parser.add_argument('--destination', type=Path)
+args = parser.parse_args()
+row = by_name[args.name]
+prefixes = row['reconstruction_prefixes']
+assert isinstance(prefixes, list) and set(prefixes) <= {'sha256', 'git'}
+raw = (ROOT / row['path']).read_bytes()
+assert 'sha256:' + hashlib.sha256(raw).hexdigest() == row['published_sha256']
+
+
+def original(value):
+    if isinstance(value, dict):
+        return {key: original(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return [original(item) for item in value]
+    if 'sha256' in prefixes and isinstance(value, str) and re.fullmatch(r'sha256:[0-9a-f]{64}', value):
+        return value[7:]
+    if 'git' in prefixes and isinstance(value, str) and re.fullmatch(r'git:[0-9a-f]{40}', value):
+        return value[4:]
+    return value
+
+
+restored = (json.dumps(original(json.loads(raw)), indent=2) + '\n').encode()
+assert 'sha256:' + hashlib.sha256(restored).hexdigest() == row['original_sha256']
+if args.destination is not None:
+    with args.destination.open('xb') as output:
+        output.write(restored)
+print(json.dumps({'name': args.name, 'frozen_original_verified': True,
+                  'written': args.destination is not None}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/recover_pending.py b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/recover_pending.py
new file mode 100644
index 00000000..8383c75c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/recover_pending.py
@@ -0,0 +1,86 @@
+"""Commit authoritative notes before normal projection; preserve pending history."""
+from pathlib import Path
+import hashlib
+import json
+import subprocess
+
+ROOT = Path('/home/worsch/the-custodian')
+HERE = Path(__file__).resolve().parent
+BASE = '05df7c3ee4d31879e7e0074e3210656b4f795794'
+PENDING = '518369dbee08b7f7690ee70d0cbc405ea4158397'
+
+
+def git(*args):
+    return subprocess.check_output(['git', '-C', str(ROOT), *args],
+                                   stderr=subprocess.PIPE, timeout=45).decode().strip()
+
+
+def run(label, argv, timeout):
+    result = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout)
+    (HERE / (label + '.stdout.txt')).write_text(result.stdout)
+    (HERE / (label + '.stderr.txt')).write_text(result.stderr)
+    assert result.returncode == 0, label + ' refused; stop with original outcome retained'
+    return result.stdout
+
+
+def preserve(restore=False):
+    rows = json.loads((HERE.parent / 'source-corrections-publication-r1/protected-state.json').read_text())
+    for row in rows:
+        path = ROOT / row['path']
+        if restore:
+            path.write_bytes((HERE / 'protected-backup' / row['path']).read_bytes())
+            mode, oid, stage, _ = row['index'].split()
+            assert stage == '0'
+            git('update-index', '--cacheinfo', mode, oid, row['path'])
+        assert hashlib.sha256(path.read_bytes()).hexdigest() == row['sha256']
+        assert git('ls-files', '--stage', '--', row['path']) == row['index']
+
+
+assert git('rev-parse', 'HEAD') == PENDING
+assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == BASE
+preserve()
+cfg = json.loads((HERE / 'plan.json').read_text())
+assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', PENDING).splitlines()) == {r['path'] for r in cfg['batches'][0]}
+notes = cfg['batches'][-1]
+assert len(notes) == 2 and any(r['path'].startswith('workplans/') for r in notes)
+for row in notes:
+    assert hashlib.sha256((ROOT / row['path']).read_bytes()).hexdigest() == row['sha256']
+paths = [r['path'] for r in notes]
+git('add', '--', *paths)
+run('authoritative-notes-commit', ['git', 'commit', '--only', '-m',
+    'Record published owner work and actual Forgejo consumer compatibility', '--', *paths], 240)
+head = git('rev-parse', 'HEAD')
+assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).splitlines()) == set(paths)
+try:
+    run('authoritative-notes-consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300)
+    projection = json.loads(run('authoritative-notes-sync', ['/home/worsch/repo-manager/.venv/bin/rmgr',
+        'sync', '--path', str(ROOT), '--push'], 180))
+finally:
+    preserve(restore=True)
+receipt = projection['receipt']
+assert projection['ok'] and projection['status'] in ('applied', 'noop')
+assert receipt['expected_commit'] == receipt['derived_commit'] == head
+assert (receipt['instance_role'], receipt['instance_label']) == ('primary', 'railiance01')
+assert receipt['outcome']['counts']['retired'] == 0
+assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == head
+(HERE / 'plan-before-reorder.json').write_text(json.dumps(cfg, indent=2) + '\n')
+cfg['batches'] = [cfg['batches'][0], notes, *cfg['batches'][1:-1]]
+publisher = HERE / 'publish.py'
+for batch in cfg['batches']:
+    for row in batch:
+        if row['path'] == str(publisher.relative_to(ROOT)):
+            row['sha256'] = hashlib.sha256(publisher.read_bytes()).hexdigest()
+            row['bytes'] = publisher.stat().st_size
+(HERE / 'plan.json').write_text(json.dumps(cfg, indent=2) + '\n')
+state = {'head': head, 'completed': [
+    {'batch': 1, 'commit': PENDING, 'files': len(cfg['batches'][0]),
+     'publication': 'verified as unchanged ancestor of the exact projected notes commit'},
+    {'batch': 2, 'commit': head, 'files': 2, 'required_consistency': 'passed'}]}
+(HERE / 'state.json').write_text(json.dumps(state, indent=2) + '\n')
+(HERE / 'dirty-workplan-refinement.json').write_text(json.dumps({
+    'original_refusal': 'pending_commit: authoritative workplan files have uncommitted changes',
+    'pending_original_commit_retained': PENDING, 'notes_commit': head,
+    'resolution': 'Commit the authoritative workplan notes before projection. Later batches contain evidence only. Normal hooks, push and primary projection unchanged.',
+    'original_dirty_paths_preserved': 8, 'native_actions': False}, indent=2) + '\n')
+print(json.dumps({'status': 'published_source_and_authoritative_notes', 'commit': head,
+                  'original_commit_retained': PENDING, 'remaining_evidence_batches': len(cfg['batches']) - 2}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/verify_current.py b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/verify_current.py
new file mode 100644
index 00000000..7e5f7b89
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/verify_current.py
@@ -0,0 +1,97 @@
+"""Verify this source checkpoint, current primary bindings and original edits."""
+from pathlib import Path
+import datetime
+import hashlib
+import json
+import re
+import subprocess
+import urllib.request
+
+ROOT = Path('/home/worsch/the-custodian')
+HERE = Path(__file__).resolve().parent
+summary = json.loads((HERE / 'publication-summary.json').read_text())
+
+
+def git(root, *args):
+    return subprocess.check_output(['git', '-C', str(root), *args],
+                                   stderr=subprocess.PIPE, timeout=45).decode().strip()
+
+
+def get(path):
+    with urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=20) as response:
+        return json.load(response)
+
+
+snapshot = summary['root_commit'].removeprefix('git:')
+head = git(ROOT, 'rev-parse', 'HEAD')
+projection = json.loads((HERE / 'close-sync.json').read_text())
+receipt = projection['receipt']
+assert projection['ok'] and projection['status'] in ('applied', 'noop')
+assert projection['commit'] == receipt['expected_commit'] == receipt['derived_commit'] == head
+assert (receipt['instance_role'], receipt['instance_label']) == ('primary', 'railiance01')
+assert receipt['outcome']['counts']['retired'] == 0
+assert git(ROOT, 'ls-remote', 'origin', 'refs/heads/main').split()[0] == head
+exceptions = {row['path']: row['sha256'] for row in summary['current_source_exceptions']}
+for row in summary['files']:
+    committed = subprocess.check_output(['git', '-C', str(ROOT), 'show', snapshot + ':' + row['path']])
+    assert 'sha256:' + hashlib.sha256(committed).hexdigest() == row['sha256']
+    current_expected = exceptions.get(row['path'], row['sha256'])
+    assert 'sha256:' + hashlib.sha256((ROOT / row['path']).read_bytes()).hexdigest() == current_expected
+    current_committed = subprocess.check_output(['git', '-C', str(ROOT), 'show', head + ':' + row['path']])
+    assert 'sha256:' + hashlib.sha256(current_committed).hexdigest() == current_expected
+protected = json.loads((HERE.parent / 'source-corrections-publication-r1/protected-state.json').read_text())
+for row in protected:
+    assert hashlib.sha256((ROOT / row['path']).read_bytes()).hexdigest() == row['sha256']
+    assert git(ROOT, 'ls-files', '--stage', '--', row['path']) == row['index']
+assert set(git(ROOT, 'diff', '--name-only', 'HEAD').splitlines()) == {r['path'] for r in protected}
+for owner, expected in summary['expected_owner_heads'].items():
+    path = ROOT.parent / owner
+    assert git(path, 'rev-parse', 'HEAD') == expected.removeprefix('git:')
+    assert git(path, 'ls-remote', 'origin', 'refs/heads/main').split()[0] == expected.removeprefix('git:')
+checks = []
+for owner, filename, count in [
+    ('the-custodian', 'CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md', 6),
+    ('ops-warden', 'WARDEN-WP-0044-security-case-follow-through.md', 4),
+    ('net-kingdom', 'NK-WP-0048-security-case-types.md', 39),
+    ('key-cape', 'KEY-WP-0039-openbao-negative-probe-tokens.md', 3),
+    ('railiance-platform', 'RPF-WP-0060-browser-case-platform-bindings.md', 4),
+]:
+    text = (ROOT.parent / owner / 'workplans' / filename).read_text()
+    wp = re.search(r'state_hub_workstream_id: "([^"]+)"', text).group(1)
+    tasks = get('/tasks/?workplan_id=' + wp)
+    assert len(tasks) == count
+    by_uuid = {t['id']: t for t in tasks}
+    rows = []
+    for block in re.findall(r'```task\n.*?```', text, re.S):
+        record = re.search(r'^id: (.+)$', block, re.M).group(1)
+        uid = re.search(r'state_hub_task_id: "([^"]+)"', block).group(1)
+        status = re.search(r'^status: (.+)$', block, re.M).group(1)
+        actual = by_uuid[uid]
+        assert (actual['record_id'], actual['status'], actual['workplan_id']) == (record, status, wp)
+        rows.append({'record_id': record, 'uuid': uid, 'status': status})
+    assert len(rows) == count
+    item = {'owner': owner, 'task_count': count, 'workplan_uuid': wp, 'bindings': rows}
+    if owner == 'net-kingdom':
+        selected = {row['record_id']: row['uuid'] for row in rows}
+        dependencies = get('/workplans/' + wp + '/dependencies/')
+        matching = [d for d in dependencies if d.get('from_task_id') == selected['NK-WP-0048-T39']
+                    and d.get('to_task_id') == selected['NK-WP-0048-T38']]
+        assert len(matching) == 1 and matching[0]['relationship_type'] == 'starts_after'
+        assert matching[0]['source_commit'] == summary['expected_owner_heads'][owner].removeprefix('git:')
+        item['release_dependency'] = matching[0]
+    checks.append(item)
+for name in [r['path'] for r in [json.loads((HERE / 'public-digest-refinement.json').read_text()),
+             *json.loads((HERE / 'public-digest-refinement.json').read_text())['additional_metadata_derivatives']]]:
+    subprocess.run(['python3', str(HERE / 'reconstruct_public_metadata.py'),
+                    str((ROOT / name).relative_to(HERE.parent))], check=True, stdout=subprocess.DEVNULL)
+result = {'status': 'verified', 'root_commit': 'git:' + head,
+          'frozen_publication_snapshot': 'git:' + snapshot, 'snapshot_files_verified': len(summary['files']),
+          'current_document_delta_verified': list(exceptions), 'source_primary_bindings': checks,
+          'task_bindings_verified': sum(c['task_count'] for c in checks), 'protected_original_paths': len(protected),
+          'owner_heads': summary['expected_owner_heads'], 'public_original_metadata_reconstructions': 4,
+          'all_sixteen_native_gates': 'open', 'goal': 'active',
+          'observed_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}
+(HERE / 'final-verification.json').write_text(json.dumps(result, indent=2) + '\n')
+print(json.dumps({'status': 'verified', 'root_commit': head, 'files': len(summary['files']),
+                  'task_bindings': result['task_bindings_verified'], 'preserved_original_paths': len(protected),
+                  'public_original_metadata_reconstructions': 4, 'goal': 'active'}))
diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md
index a1ef3518..c972f5cf 100644
--- a/docs/netkingdom-target-implementation.md
+++ b/docs/netkingdom-target-implementation.md
@@ -1190,3 +1190,44 @@ Evidence: dated `platform-broker-followthrough-r1/`, `platform-broker-review-r1/
 `apps-chart-projection-r1/` and `nk48-consumer-compatibility-r1/` packets. Source
 preparation and owner acknowledgment remain separate. All sixteen native target
 gates and KEY39's actual negative/expiry/revoke/cleanup acceptance remain open.
+
+### Exact consumer source implementation and full backend verification
+
+NK48-T38 records the completed seven-path Forgejo source candidate and its
+independent technical review. The full actual patched 11.0.3 backend executable
+compiled offline with verified Go 1.24.3 in 304.79 seconds. Eight source/provider
+fixture race tests, five actual package tests and three independent actual-package
+test functions pass. The latter include fourteen named subtests. This advances
+beyond extracted-method fixtures; frontend/release/container and image provenance
+remain separate work. T39 tracks the actual owner release build; T37 retains
+architecture acceptance, owner integration and exact re-freeze. The application
+profile's authenticated Access Engine decision is still required; a local claim
+gate does not complete that profile or admit a single-PDP exception.
+
+The original omission proposal and build/test harness failures are retained.
+Actual provider merge requires a current negative result rather than omission.
+Actual chart omission also leaves persisted OAuth sources behind. T34's inverse
+therefore needs authoritative application-source before/post/current state and
+safe restoration/removal before any image downgrade. Linked users can make
+deletion refuse; preserving the extended image for reconciliation is safer than
+weakening the gate through a downgrade. No source-only tool or Helm revision
+supplies that capability, its authority, writer exclusion or durable journal.
+Runtime client-secret argv confidentiality remains an explicit owner obligation.
+
+The corrected delivery r2 command mechanics separately pass the coordinator's
+network-disabled reproduction of 42 tests plus four regression assertions. Exact
+controller freshness semantics, known API defaults, malformed responses, fixed
+v1 requests and bounded output/process handling are implemented in that source
+candidate. Cross-resource Store exclusion and actual authority/session/journal/
+evidence/revocation remain missing. Its field-selected collection read also needs
+the exact owner verb/resource restriction reviewed. The production factory
+continues to refuse; these tests do not complete Platform T04 or native delivery.
+
+Evidence in the dated packet: `forgejo-required-claim-values-r1/`,
+`forgejo-required-claim-values-review-r1/`, `platform-delivery-backend-r2/`,
+`platform-delivery-root-review-r2/`, `nk48-consumer-gate-implementation-r1/`
+and the active `apps-forgejo-release-build-r1/`. Source publication uses typed
+public digest/Git metadata where the unchanged scanner rejected raw public
+identifiers. Exact frozen original bytes are verified and reconstructable using
+`owner-followthrough-publication-r1/reconstruct_public_metadata.py`; its receipt
+records the derivation. Code/chart bytes, scanner rules and authority are unchanged.