docs: retain legacy Custodian projection refusal explicitly

docs/assessments/2026-09-09-helixforge-replay-and-operating-contract.json

@@ -284,6 +284,10 @@
     {
       "id": "4e30ab0a-d298-4fab-a47d-d411d749e29d",
       "task_id": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19"
+    },
+    {
+      "id": "7440d826-b1bd-438a-9fd8-8e6f369b8cf7",
+      "scope": "custodian publication exception"
     }
   ],
   "governed_factory_attempts": 0,
@@ -294,5 +298,11 @@
     "sandbox artifact import into original grant/lease transaction",
     "named operating/profile/Railiance admission",
     "G1-G4 live evidence and fourteen-day G5"
-  ]
+  ],
+  "custodian_projection": {
+    "status": "blocked-before-reconcile",
+    "reason": "pre-existing invalid CUST-WP-0000b and duplicate unqualified task IDs",
+    "owner_record": "CUST-IN-0017",
+    "git_publication": "separate from failed work-record projection"
+  }
 }

docs/assessments/2026-09-09-helixforge-replay-and-operating-contract.md

@@ -56,3 +56,9 @@ throughput are inferred. The factory ledger still contains zero governed
 attempts; all G0-G5 acceptance gates remain open and the fourteen-day observation
 window has not begun. Source-backed task fields are verified after publication;
 any repaired projection omissions remain an unresolved Repo Manager defect.
+
+Custodian publication exception: its full Repo Manager projection refuses the
+pre-existing CUST-WP-0000b identity and repeated unqualified T01–T10 task IDs.
+Existing CUST-IN-0017 owns these legacy identity failures. The assessment is
+committed/published through Git; no Custodian primary projection is claimed.
+Secrets Engine and the factory project both have exact primary receipts.