diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/deployment.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/deployment.json
new file mode 100644
index 00000000..e54840a2
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/deployment.json
@@ -0,0 +1,14 @@
+{
+  "started_utc": "2026-10-19T13:34:20.566225+00:00",
+  "command": [
+    "make",
+    "policy-nexus-deploy",
+    "POLICY_NEXUS_TARGET=railiance01"
+  ],
+  "atomic": true,
+  "attempt": 1,
+  "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
+  "completed_utc": "2026-10-19T13:34:26.648713+00:00",
+  "returncode": 0,
+  "raw_output_suppressed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/execution-receipt.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/execution-receipt.json
new file mode 100644
index 00000000..054b82fb
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/execution-receipt.json
@@ -0,0 +1,83 @@
+{
+  "proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1",
+  "approved_revision": 1,
+  "approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f",
+  "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
+  "result": "verified",
+  "helm_revision": 10,
+  "rollback_required": false,
+  "rollback_revision": 9,
+  "candidate_source_revision": "9fabcce1cb4c83165bcaba8be58d76788b4d87a1",
+  "candidate_origin": "local owner-format build; native CI run89 retained failed, no new CI success claimed",
+  "change_gate": {
+    "decision": "the-custodian/docs/kubernetes-change-gate-decision.md",
+    "target_tier": "production",
+    "readiness_state": "production-approved",
+    "path": "direct-administer-transition",
+    "auth_mode": "ADMINISTER @ realm:kubernetes/railiance01",
+    "activation": "APPROVED",
+    "evidence_boundary": "target-audited",
+    "transition_ends": "2026-12-21"
+  },
+  "native": {
+    "capture_utc": "2026-10-19T13:35:06.098696+00:00",
+    "cluster_mutated": false,
+    "expected_node_ip": "92.205.62.239",
+    "expected_node_ip_present": true,
+    "helm_revision": 10,
+    "helm_status": "deployed",
+    "image_matches_candidate": true,
+    "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
+    "ready_replicas": 1,
+    "release_pin_matches": {
+      "publication-manifest-digest": true,
+      "source-inventory-digest": true,
+      "source-set-digest": true
+    },
+    "replicas": 1,
+    "secret_values_observed": false,
+    "ssh_alias": "railiance01"
+  },
+  "public": {
+    "verified": true,
+    "capture_utc": "2026-10-19T13:36:20.944233+00:00",
+    "hashes": {
+      "publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e",
+      "source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd",
+      "source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529"
+    },
+    "source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
+    "document_count": 74,
+    "previous73_source_digests_unchanged": true,
+    "added_document": "canon-build-mode-change-authorization",
+    "all_canonical_and_revision_pages_byte_equal_candidate": true,
+    "page_and_artifact_count": 150,
+    "guardrail_expiry_banner": "Expires on: production-close-down",
+    "guardrail_json_byte_equal_verified_candidate": true,
+    "guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd",
+    "tls_verified": true,
+    "refinements": [
+      "Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.",
+      "Second verifier expected source expires_on label rather than rendered Expires on.",
+      "Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged."
+    ]
+  },
+  "deployment": {
+    "started_utc": "2026-10-19T13:34:20.566225+00:00",
+    "command": [
+      "make",
+      "policy-nexus-deploy",
+      "POLICY_NEXUS_TARGET=railiance01"
+    ],
+    "atomic": true,
+    "attempt": 1,
+    "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
+    "completed_utc": "2026-10-19T13:34:26.648713+00:00",
+    "returncode": 0,
+    "raw_output_suppressed": true
+  },
+  "owner_source_commits": {
+    "rapp-policy-nexus": "6ead90ffa4ae5742c37c292485762e83113382c3",
+    "railiance-apps": "3be92daf74a7572319bfe94dd882a70430528343"
+  }
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/execution-start.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/execution-start.json
new file mode 100644
index 00000000..c4e25197
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/execution-start.json
@@ -0,0 +1,12 @@
+{
+  "proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1",
+  "approved_revision": 1,
+  "approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f",
+  "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
+  "approval_text": "Approve this exact publication and deployment",
+  "started_utc": "2026-10-19T13:24:06.363210+00:00",
+  "source_preconditions_verified": true,
+  "status": "started",
+  "image_digest": "sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1",
+  "live_mutation": false
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/headroom.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/headroom.json
new file mode 100644
index 00000000..dc5f8035
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/headroom.json
@@ -0,0 +1,18 @@
+{
+  "capture_utc": "2026-10-19T13:29:59.232999+00:00",
+  "allocated_resources": {
+    "cpu": {
+      "requests": "3605m",
+      "requests_percent": 90,
+      "limits": "37500m",
+      "limits_percent": 937
+    },
+    "memory": {
+      "requests": "9856Mi",
+      "requests_percent": 61,
+      "limits": "34562Mi",
+      "limits_percent": 216
+    }
+  },
+  "raw_output_suppressed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/immediate-pre-deploy-observation.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/immediate-pre-deploy-observation.json
new file mode 100644
index 00000000..43ea1f3d
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/immediate-pre-deploy-observation.json
@@ -0,0 +1,19 @@
+{
+  "capture_utc": "2026-10-19T13:34:21.152132+00:00",
+  "cluster_mutated": false,
+  "expected_node_ip": "92.205.62.239",
+  "expected_node_ip_present": true,
+  "helm_revision": 9,
+  "helm_status": "deployed",
+  "image_matches_rollback": true,
+  "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
+  "ready_replicas": 1,
+  "release_pin_matches": {
+    "publication-manifest-digest": true,
+    "source-inventory-digest": true,
+    "source-set-digest": true
+  },
+  "replicas": 1,
+  "secret_values_observed": false,
+  "ssh_alias": "railiance01"
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/native-verification.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/native-verification.json
new file mode 100644
index 00000000..02efc075
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/native-verification.json
@@ -0,0 +1,19 @@
+{
+  "capture_utc": "2026-10-19T13:35:06.098696+00:00",
+  "cluster_mutated": false,
+  "expected_node_ip": "92.205.62.239",
+  "expected_node_ip_present": true,
+  "helm_revision": 10,
+  "helm_status": "deployed",
+  "image_matches_candidate": true,
+  "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
+  "ready_replicas": 1,
+  "release_pin_matches": {
+    "publication-manifest-digest": true,
+    "source-inventory-digest": true,
+    "source-set-digest": true
+  },
+  "replicas": 1,
+  "secret_values_observed": false,
+  "ssh_alias": "railiance01"
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/observe-candidate.py b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/observe-candidate.py
new file mode 100644
index 00000000..12301c55
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/observe-candidate.py
@@ -0,0 +1,31 @@
+import datetime,hashlib,json,os,pathlib,re,subprocess
+EXPECTED={
+ 'image':'forgejo.coulomb.social/coulomb/policy-nexus@sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1',
+ 'publication-manifest-digest':'8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e',
+ 'source-inventory-digest':'e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd',
+ 'source-set-digest':'b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682'}
+def run(args):
+ p=subprocess.run(args,stdout=subprocess.PIPE,stderr=subprocess.PIPE,env=dict(os.environ,KUBECONFIG='/etc/rancher/k3s/k3s.yaml'),timeout=20)
+ if p.returncode:raise ValueError('command_refused')
+ return p.stdout.decode().strip()
+try:
+ out={'capture_utc':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ssh_alias':'railiance01','expected_node_ip':'92.205.62.239','secret_values_observed':False,'cluster_mutated':False}
+ nodes=json.loads(run(['kubectl','get','nodes','-o','json']))
+ out['expected_node_ip_present']=any(a.get('address')=='92.205.62.239' for n in nodes['items'] for a in n['status']['addresses'])
+ if not out['expected_node_ip_present']:raise ValueError('target_mismatch')
+ out['machine_id_sha256']=hashlib.sha256(pathlib.Path('/etc/machine-id').read_bytes()).hexdigest()
+ base=['kubectl','-n','policy-nexus','get','deployment','policy-nexus','-o']
+ actual=run(base+['jsonpath={.spec.template.spec.containers[0].image}'])
+ out['image_matches_candidate']=actual==EXPECTED['image']
+ out['release_pin_matches']={}
+ for key in list(EXPECTED)[1:]:
+  value=run(base+['jsonpath={.metadata.annotations.policy\\.coulomb\\.social/'+key+'}'])
+  out['release_pin_matches'][key]=value==EXPECTED[key]
+ for key,expr in [('replicas','.spec.replicas'),('ready_replicas','.status.readyReplicas')]:
+  value=run(base+['jsonpath={'+expr+'}']);out[key]=int(value) if value.isdigit() else None
+ releases=json.loads(run(['helm','list','--namespace','policy-nexus','--filter','^policy-nexus$','-o','json']))
+ if len(releases)!=1:raise ValueError('release_count')
+ r=releases[0];out['helm_revision']=int(r['revision']);out['helm_status']=r['status'] if r['status'] in ['deployed','failed','pending-upgrade','pending-rollback'] else 'other'
+ print(json.dumps(out,sort_keys=True))
+except Exception:
+ print(json.dumps({'observation_completed':False,'reason':'bounded_read_failed','raw_errors_suppressed':True}))
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-checks.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-checks.json
new file mode 100644
index 00000000..1dea3c05
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-checks.json
@@ -0,0 +1,38 @@
+[
+  {
+    "repo": "rapp-policy-nexus",
+    "check": [
+      "make",
+      "check"
+    ],
+    "returncode": 0,
+    "raw_output_suppressed": true
+  },
+  {
+    "repo": "railiance-apps",
+    "check": [
+      "make",
+      "policy-nexus-check-binding"
+    ],
+    "returncode": 0,
+    "raw_output_suppressed": true
+  },
+  {
+    "repo": "railiance-apps",
+    "check": [
+      "make",
+      "policy-nexus-check-image"
+    ],
+    "returncode": 0,
+    "raw_output_suppressed": true
+  },
+  {
+    "repo": "railiance-apps",
+    "check": [
+      "make",
+      "policy-nexus-render"
+    ],
+    "returncode": 2,
+    "raw_output_suppressed": true
+  }
+]
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-closeout.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-closeout.json
new file mode 100644
index 00000000..45d0b17a
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-closeout.json
@@ -0,0 +1,22 @@
+{
+  "capture_utc": "2026-10-19T15:55:47.761612+00:00",
+  "repos": {
+    "policy-nexus": {
+      "head": "fa6ee926b6f4000cebd7903918474ba5ee7beaf6",
+      "status": "",
+      "clean": true
+    },
+    "rapp-policy-nexus": {
+      "head": "5f2f0d6508bf81caff7c7a1852f8d1067d5f9560",
+      "status": "",
+      "clean": true
+    },
+    "railiance-apps": {
+      "head": "3851865c873b3b36550c0aa2c03e53509fe41ad2",
+      "status": "",
+      "clean": true
+    }
+  },
+  "push_performed": false,
+  "new_ci_triggered": false
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-server-dry-run.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-server-dry-run.json
new file mode 100644
index 00000000..b877905e
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-server-dry-run.json
@@ -0,0 +1,4 @@
+{
+  "owner_server_dry_run_returncode": 0,
+  "raw_output_suppressed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-smoke.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-smoke.json
new file mode 100644
index 00000000..9cf5a7b0
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/owner-smoke.json
@@ -0,0 +1,4 @@
+{
+  "owner_smoke_returncode": 0,
+  "raw_errors_suppressed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/pre-execution-live-observation.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/pre-execution-live-observation.json
new file mode 100644
index 00000000..7e7af6fd
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/pre-execution-live-observation.json
@@ -0,0 +1,19 @@
+{
+  "capture_utc": "2026-10-19T13:26:26.371772+00:00",
+  "cluster_mutated": false,
+  "expected_node_ip": "92.205.62.239",
+  "expected_node_ip_present": true,
+  "helm_revision": 9,
+  "helm_status": "deployed",
+  "image_matches_rollback": true,
+  "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
+  "ready_replicas": 1,
+  "release_pin_matches": {
+    "publication-manifest-digest": true,
+    "source-inventory-digest": true,
+    "source-set-digest": true
+  },
+  "replicas": 1,
+  "secret_values_observed": false,
+  "ssh_alias": "railiance01"
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification-initial-check-failure.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification-initial-check-failure.json
new file mode 100644
index 00000000..0f53dc7e
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification-initial-check-failure.json
@@ -0,0 +1,5 @@
+{
+  "verified": false,
+  "failure_class": "AssertionError",
+  "raw_errors_suppressed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification-label-check-failure.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification-label-check-failure.json
new file mode 100644
index 00000000..9100fd68
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification-label-check-failure.json
@@ -0,0 +1,6 @@
+{
+  "verified": false,
+  "stage": "guardrail_expiry",
+  "failure_class": "AssertionError",
+  "raw_errors_suppressed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification.json
new file mode 100644
index 00000000..27c8a07a
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/public-verification.json
@@ -0,0 +1,24 @@
+{
+  "verified": true,
+  "capture_utc": "2026-10-19T13:36:20.944233+00:00",
+  "hashes": {
+    "publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e",
+    "source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd",
+    "source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529"
+  },
+  "source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
+  "document_count": 74,
+  "previous73_source_digests_unchanged": true,
+  "added_document": "canon-build-mode-change-authorization",
+  "all_canonical_and_revision_pages_byte_equal_candidate": true,
+  "page_and_artifact_count": 150,
+  "guardrail_expiry_banner": "Expires on: production-close-down",
+  "guardrail_json_byte_equal_verified_candidate": true,
+  "guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd",
+  "tls_verified": true,
+  "refinements": [
+    "Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.",
+    "Second verifier expected source expires_on label rather than rendered Expires on.",
+    "Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged."
+  ]
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/registry-transfer.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/registry-transfer.json
new file mode 100644
index 00000000..5d18c6c5
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/registry-transfer.json
@@ -0,0 +1,10 @@
+{
+  "utc": "2026-10-19T13:26:48.865571+00:00",
+  "tag": "forgejo.coulomb.social/coulomb/policy-nexus:source-b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
+  "returncode": 0,
+  "manifest_digests": [
+    "sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1"
+  ],
+  "raw_errors_suppressed": true,
+  "main_updated": false
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/registry-verification.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/registry-verification.json
new file mode 100644
index 00000000..961a9f99
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/registry-verification.json
@@ -0,0 +1,7 @@
+{
+  "manifest_digest": "sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1",
+  "remote_blob_count": 13,
+  "remote_blobs_byte_equal_to_verified_local_oci": true,
+  "paired_release_files_in_verified_layers": true,
+  "anonymous_pull_verified": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/render-verification.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/render-verification.json
new file mode 100644
index 00000000..ac2756b0
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/render-verification.json
@@ -0,0 +1,6 @@
+{
+  "render_byte_equal_approved": true,
+  "render_sha256": "62b369b913d610508fb135834e7cb166f62649f3d9e61eddbe02e8fca542a953",
+  "escalated_owner_render_returncode": 0,
+  "diff_check_passed": true
+}
diff --git a/docs/changes/CUST-WP-0079/policy-publication-r1-execution/server-dry-run.json b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/server-dry-run.json
new file mode 100644
index 00000000..d7ef9c77
--- /dev/null
+++ b/docs/changes/CUST-WP-0079/policy-publication-r1-execution/server-dry-run.json
@@ -0,0 +1,10 @@
+{
+  "capture_utc": "2026-10-19T13:30:00.318306+00:00",
+  "returncode": 0,
+  "server_dry_run_passed": true,
+  "resource_names_match": true,
+  "resource_count": 9,
+  "stderr_present": false,
+  "raw_errors_suppressed": true,
+  "cluster_mutated": false
+}
diff --git a/docs/changes/custodian-delivery-restart-2026-10-19.md b/docs/changes/custodian-delivery-restart-2026-10-19.md
new file mode 100644
index 00000000..17f44ca5
--- /dev/null
+++ b/docs/changes/custodian-delivery-restart-2026-10-19.md
@@ -0,0 +1,126 @@
+# Restart handoff — 2026-10-19
+
+User requested wind-down because of token limits. Resume the existing goal for
+CUST-WP-0071, CUST-WP-0073 and CUST-WP-0079; do not start a new plan or repeat
+completed measurements. Goal is paused, not complete. Source workplans retain
+open acceptance tasks.
+
+## Decisions that remain authoritative
+
+- Keep generated briefs locally and ignored; do not track Git snapshots. Fleet
+  migration and State Hub installed CLI repair are complete.
+- Use the existing Activity Core worker, pinned scripts and private retained state.
+  Both daily/weekly definitions stay disabled until exact runtime acceptance.
+- Isolate this actual interactive Codex assignment first. A child-agent rehearsal
+  is not acceptance. No credential cutover, WSL provisioning or rotation occurred.
+- Configurable synthetic workloads may establish provisional sizing; human
+  workflow acceptance remains separate. Do not require a human pilot merely to
+  continue the authorized synthetic work.
+
+## Verified live change: Policy Nexus
+
+Founder explicitly approved exact publication and deployment in
+`call_5157a09329d34746a3fdf857d5a47b8d`, item 0. Original immutable packet:
+`docs/changes/CUST-WP-0079/policy-publication-r1/PLAN.md`; SHA256SUMS digest
+`309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f`.
+
+One atomic upgrade deployed approved image
+`sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1`
+as Helm revision10, Ready1/1. Native/public proof at13:36:20Z verifies all paired
+release hashes, 74 documents, previous73 source digests unchanged, all150 pages
+and artifacts byte-equal candidate. Standard and derived JSON are public.
+CUST-WP-0079-T04 is done. Evidence is the sibling `policy-publication-r1-execution/`.
+Two verifier-only date/label failures are retained; full corrected proof passed.
+No artifact refinement or rollback occurred. No fresh vulnerability scan/native
+CI success is claimed. Do not redeploy merely to resume this session.
+Supervision record retains approval, exact execution and refinements; no autopilot.
+Rollback is verified prior Helm revision9/image4e0db6, not stale rApp23df0ab3.
+
+## Provisional sizing and allocation
+
+Vergabe commits `11f7c8a`, `bfd1a2d`, `44e5458` retain maintained configs/driver,
+raw samples and failures. Latest `config/synthetic-pilot-phases.json` covers
+edits, idle, ordinary, burst, restart and recovery at1CPU/1Gi. 2971requests,
+zero errors; phase p95 256/303/336ms; startup7.266s/restart7.128s; complete coverage;
+17 focused tests. Evidence: `docs/evidence/2026-10-19-synthetic-sizing/` in owner.
+Earlier Docker restart changed its random port; failure retained, driver fixed.
+
+Keep current prototype limits provisionally. The60m request is not validated
+under shared contention. No production resources changed. CUST71T02 remains
+progress. RAPPS-WP-0014-T04 receives exact deployed-release/hardware and
+shared-contention evidence; T03 human/recovery acceptance is unchanged.
+Resource-control `RESOURCE-WP-0008` active, latest initial review `e3e996f`.
+Next consume phased evidence there and finish qualified allocation/owner review.
+
+Read-only allocation capture12:50:41Z:4000m capacity,3605m scheduled,0pending,
+395m reservation residual (not spare CPU). Retained JSON/MD/provenance in root
+`docs/evidence/2026-10-19-allocation-reconcile.*`. Subsequent source map identifies
+mas→mail-address-semantics, playwright→railiance-platform (package rapp-playwright),
+rapp-qonto→rapp-qonto. Historical capture/hash is unchanged. No tenant invented.
+
+## Disabled recurring jobs: next implementation boundary
+
+Activity Core `fed119a` embeds pinned owner scripts and mandatory input admission;
+`3b25aea` uses a protected descriptor selecting retained immutable snapshots.
+Repo Manager `3e2726f` supplies pinned Git-object offline exporter. Native issuer
+noop receipts are valid only through protected issuer custody; don't break its
+existing contract by requiring fields native noop does not emit.
+
+Existing core-hub publisher holds Forge read custody. No accepted snapshot
+transport to Activity Core exists. Prepared endpoint/receiver work is disabled;
+new downstream disclosure of exact15 private repositories needs review of the
+concrete endpoint/network delta. No new token mount or access expansion occurred.
+See Activity Core `k8s/custodian-release/publisher-access-delta.md`.
+Preserve single bounded operation per ActivityDefinition: integrate capture as
+fixed pre-run step inside custodian_security_flow, not a second operation.
+Proposed45s capture+240s command must fit existing300s envelope; actual15-repo
+capture duration/cancellation, retry idempotency and producer concurrency remain
+runtime readiness requirements, not proven by mocks. Do not loosen freshness.
+After source integration: exact image/mount/state/PVC capacity/backup/network
+review, scoped access disposition, paused real run, then unattended/delivery/
+acknowledgment/failure recovery evidence. Never enable just because source tests pass.
+
+## Interactive isolation: preparation only
+
+Retained locked proposals under `docs/changes/CUST-WP-0073/interactive-launch-r1/`,
+`interactive-launch-r2/`, `interactive-launch-r3/` and `ubuntu-dependencies-r1/`.
+Selected target: new dedicated WSL2 distribution/account custodian-codex, not
+existing production host or second UID sharing operator credentials. No import,
+admin action, auth transfer or negative-boundary acceptance performed.
+Pending user UI question: whether this chat interface offers SSH run-location or
+Hand off. No answer yet; do not treat silence as support or permission.
+Full signed dependency/rootfs bundle is `/tmp/cust73-ubuntu-dependencies-r1`;
+Git contains review subset only. Reverify full hashes/reacquire exact pins if gone.
+Actual runtime/binary, namespace/network denial, scoped auth/connector boundaries
+and real chat handoff/native allow-deny proof still required. Locked scripts are
+not executable approvals. CUST73T05 rotation remains founder-deferred.
+
+## Restart discipline
+
+Read AGENTS, environment orientation and this assignment's supervision record.
+Preserve pre-existing unrelated root dirt (old netkingdom assessment files,
+large untracked evidence tree and .kube); never blanket add/restore/delete.
+No new deployment or access approval is inferred from this handoff. Existing
+exact approval is already fulfilled for Policy Nexus; no repeat confirmation.
+Run State Hub consistency only after coherent source commits; it may push source
+and local origin tracking can be stale. Check remote SHA if needed. Previous
+sandbox sync could not write Git index; escalated retry passed90/90 with0errors.
+Record progress at close; do not score preparation as supervision success.
+
+Final provider commit/checkpoint additions follow below.
+
+- Flow final: Vergabe clean at `44e5458`; Railiance-apps handoff `170e9b7`,
+  RAPPS-WP-0014-T04 UUID `c53fcaa9-859c-5b37-a17b-0a4cd2fb0e26`.
+  Owner consistency session79197 exited0, no automation/assessment failures.
+  No active flow sessions; zero synthetic/port-check containers or networks.
+  Phased raw data `phased-sizing-run.json.gz` and `phased-comparison.json` remain
+  in Vergabe's evidence directory. No need to rerun this local workload on resume.
+
+- Policy closeout: clean owner commits `policy-nexus@fa6ee926`,
+  `rapp-policy-nexus@5f2f0d65`, `railiance-apps@3851865c` (includes prior
+  flow handoff170e9b7). No new source push/CI/rebuild was initiated by this
+  closeout. Execution sibling `execution-receipt.json` and `owner-closeout.json`
+  retain final results. Publication is complete; any source-ahead status is
+  bookkeeping, not a reason to deploy again.
+- Aggregate progress receipt: `7c6a2833-e56c-4bf8-9288-6f1d523afe62`.
+  Root closeout source commit `01dc196` records T04 done and phased sizing.