diff --git a/docs/security-close-down-checklist.md b/docs/security-close-down-checklist.md
index 8c9afdf0..06ee7a8c 100644
--- a/docs/security-close-down-checklist.md
+++ b/docs/security-close-down-checklist.md
@@ -33,3 +33,4 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi
 | 24 | Metered spend settlement (rein-aharness spend envelopes) | Opt-in per envelope since 2026-10-14 (rein-aharness `c7dceee`, `c04d1c6`; owner decision `a93619a9`): `settlement: observed-usage` charges a completed provider request its gateway-metered cost (provider-reported tokens at admitted rates) instead of its full hold, and a run max(metered requests, reported/attested cost). Unfinished requests keep full hold; overrun still freezes the envelope; `full-hold` stays the default. First use: memo `infd-20261014-b01` (3 attempts, EUR 10). Provider-reported usage is trusted until billing is compared. | Compare each observed-usage envelope's charges with provider billing before renewal; decide whether observed-usage stays allowed or envelopes return to full-hold. | rein-aharness, owner | 2026-10-14 |
 | 25 | WP-80 functional delivery before full security acceptance | Founder decision `9663d4ca-3793-4ad7-9dc1-954001d43596` prioritizes working development flows and permits later hardening. Actual Playwright human/agent commands pass through the existing authenticated workstation port-forward; this is a supervised build profile, without independent per-caller identity acceptance. No credentials distributed, new target enabled or installed control disabled. Nineteen full checkpoints and six remaining acceptance scopes transfer to live CUST-WP-0082; ledger statuses and the full target stay unchanged. [Scope and evidence](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md). | Promote/revalidate relevant hardening before customer production, target expansion or broader unattended authority. Verify the full current-identity, per-caller transport/isolation, lifecycle, recovery and audit criteria in CUST-WP-0082; close all 16 target gates and reconcile all 116 ledger entries. No automatic production approval or blanket formal requirement exception. | Custodian coordinates; existing KeyCape / Platform / NetKingdom / Forge / Apps / custody and audit owners implement | 2026-10-18 |
 | 26 | Proposed temporary Forgejo public-PKCE build profile | Not activated. Proposal `CUST80-FORGEJO-PUBLIC-BUILD-20261018` r2, SHA `fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3`, awaits actual founder decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c` and independent NetKingdom/Apps/KeyCape reviews. Candidate uses the unchanged Forgejo release, exact callback, S256 and required MFA, preserving local sign-in and existing account permissions. It intentionally defers the accepted confidential-client secret/delivery/full case lifecycle; no value is generated or distributed and no current control is disabled by preparation. [Packet](changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md). | If activated, complete the confidential-client registration and issuer/consumer custody path plus original full security acceptance under CUST-WP-0082-T20 and existing owners when promoted; revalidate before customer production or broader unattended authority. Record actual approval/execution and preserve rollback/unknown outcomes. | Custodian coordinates; NetKingdom, railiance-apps, key-cape; Platform owns later confidential custody | 2026-10-18 |
+| 27 | Owner-review digest of the flex-auth signer native admission (railiance-platform RPF-WP-0035-T14, CCR-2026-0050) | `scripts/flex_auth_signer_native.py` owner reviews now bind the admission scope **without** `expires_at`. Before, all five reviews had to bind an exact expiry at most 120 s ahead, which made asynchronous reviews impossible to collect. The 5–120 s freshness check at invocation is unchanged, and every other scope field (kid, image, CCR, source bundle, bindings, routing, operation id, founder entity) stays bound. Reviewers no longer approve the exact execution second; the founder still runs the single attended window. Source only, nothing executed. | Decide whether reviews should bind a reviewed scheduled window (start/end) again, e.g. a reviewed `window_not_before`/`window_not_after` pair bound in the digest with `expires_at` inside it. | railiance-platform | 2026-10-21 |