diff --git a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md
index bd3711f..dd7a2e6 100644
--- a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md
+++ b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md
@@ -1,5 +1,7 @@
 # Factory critical-path execution — 2026-09-08
 
+Continued on [2026-09-09: issuer pin complete and custody reviews ready](2026-09-09-helixforge-issuer-pin.md).
+
 Implemented and published prerequisite corrections in ops-warden, key-cape,
 approval-engine and audit-core, followed by local runtime installation and an
 attended OpenBao capability preflight, then verified the actual upstream issuer. The canonical integration workplan and next
diff --git a/docs/assessments/2026-09-09-helixforge-issuer-pin.json b/docs/assessments/2026-09-09-helixforge-issuer-pin.json
new file mode 100644
index 0000000..ea6b483
--- /dev/null
+++ b/docs/assessments/2026-09-09-helixforge-issuer-pin.json
@@ -0,0 +1,927 @@
+{
+  "schema": "custodian.factory-issuer-pin-continuation.v1",
+  "recorded_at": "2026-09-08T22:57:37.545227+00:00",
+  "live_pin": {
+    "schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
+    "recorded_at": "2026-09-08T22:24:00.262369+00:00",
+    "authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
+    "source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
+    "signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
+    "check_before": {
+      "before": {
+        "resource_version": "51346058",
+        "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+      },
+      "config_changed": false,
+      "deployment_changed": false,
+      "issuer_matches": false,
+      "mode": "issuer-check-live",
+      "observed_at": "2026-09-08T22:23:58.199881+00:00",
+      "prior_pin_state": "absent",
+      "schema": "netkingdom.keycape-issuer-pin.v1",
+      "secret_values_emitted": false,
+      "target": "sso/keycape-config",
+      "verified_issuer": "https://auth.coulomb.social"
+    },
+    "pin": {
+      "after": {
+        "resource_version": "58713343",
+        "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+      },
+      "before": {
+        "resource_version": "51346058",
+        "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+      },
+      "config_changed": true,
+      "deployment_changed": false,
+      "issuer_matches": true,
+      "mode": "issuer-pin-live",
+      "observed_at": "2026-09-08T22:23:58.727554+00:00",
+      "other_secret_data_unchanged": true,
+      "prior_pin_state": "absent",
+      "schema": "netkingdom.keycape-issuer-pin.v1",
+      "secret_values_emitted": false,
+      "target": "sso/keycape-config",
+      "unrelated_config_bytes_preserved": true,
+      "verified_issuer": "https://auth.coulomb.social"
+    },
+    "check_after": {
+      "before": {
+        "resource_version": "58713343",
+        "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+      },
+      "config_changed": false,
+      "deployment_changed": false,
+      "issuer_matches": true,
+      "mode": "issuer-check-live",
+      "observed_at": "2026-09-08T22:23:59.920100+00:00",
+      "prior_pin_state": "matching",
+      "schema": "netkingdom.keycape-issuer-pin.v1",
+      "secret_values_emitted": false,
+      "target": "sso/keycape-config",
+      "verified_issuer": "https://auth.coulomb.social"
+    },
+    "deployment_before": {
+      "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+      "resource_version": "55113259",
+      "generation": 29,
+      "images": [
+        {
+          "name": "keycape",
+          "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+        }
+      ],
+      "ready_replicas": 1,
+      "available_replicas": 1
+    },
+    "deployment_after": {
+      "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+      "resource_version": "55113259",
+      "generation": 29,
+      "images": [
+        {
+          "name": "keycape",
+          "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+        }
+      ],
+      "ready_replicas": 1,
+      "available_replicas": 1
+    },
+    "deployment_unchanged": true,
+    "tests_passed": 13,
+    "credential_values_emitted": false,
+    "custody_activated": false,
+    "ccr_reviews_completed": false,
+    "process_reload_or_new_image_proved": false
+  },
+  "review_apply_gates": [
+    {
+      "ccr": "CCR-2026-0017",
+      "apply_plan_refused": true,
+      "reason": "requires status approved, got proposed",
+      "exit_code": 1
+    },
+    {
+      "ccr": "CCR-2026-0018",
+      "apply_plan_refused": true,
+      "reason": "requires status approved, got proposed",
+      "exit_code": 1
+    }
+  ],
+  "projection_receipts": [
+    {
+      "repo": "net-kingdom",
+      "commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+      "method": "Supported primary reconciliation endpoint after scoped sole-retirement review; CLI retry blocked by idempotency-key conflict",
+      "receipt": {
+        "schema": "state-hub.repository-projection-reconcile.v1",
+        "instance_role": "primary",
+        "instance_label": "railiance01",
+        "expected_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+        "derived_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+        "outcome": {
+          "schema": "state-hub.projection-reset.v1",
+          "repo_slug": "net-kingdom",
+          "commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+          "status": "applied",
+          "counts": {
+            "created": 0,
+            "updated": 44,
+            "retired": 1,
+            "refused": 0,
+            "released": 0,
+            "created_tasks": 0,
+            "updated_tasks": 98,
+            "cancelled_tasks": 0
+          },
+          "created": [],
+          "updated": [
+            "NET-WP-0015",
+            "NET-WP-0016",
+            "NET-WP-0017",
+            "NET-WP-0018",
+            "NET-WP-0019",
+            "NET-WP-0020",
+            "NK-WP-0001",
+            "NK-WP-0002",
+            "NK-WP-0003",
+            "NK-WP-0004",
+            "NK-WP-0005",
+            "NK-WP-0006",
+            "NK-WP-0007",
+            "NK-WP-0008",
+            "NK-WP-0009",
+            "NK-WP-0010",
+            "NK-WP-0011",
+            "NK-WP-0012",
+            "NK-WP-0013",
+            "NK-WP-0014",
+            "NK-WP-0015",
+            "NK-WP-0016",
+            "NK-WP-0017",
+            "NK-WP-0018",
+            "NK-WP-0019",
+            "NK-WP-0021",
+            "NK-WP-0022",
+            "NK-WP-0023",
+            "NK-WP-0024",
+            "NK-WP-0025",
+            "NK-WP-0026",
+            "NK-WP-0027",
+            "NK-WP-0028",
+            "NK-WP-0029",
+            "NK-WP-0030",
+            "NK-WP-0031",
+            "NK-WP-0032",
+            "NK-WP-0033",
+            "NK-WP-0034",
+            "NK-WP-0035",
+            "NK-WP-ADHOC-2026-06-14",
+            "NK-WP-ADHOC-2026-07-02",
+            "NK-WP-ADHOC-2026-08-14",
+            "NK-WP-ADHOC-2026-08-23"
+          ],
+          "retired": [
+            "nk-wp-0035"
+          ],
+          "released": [],
+          "created_tasks": [],
+          "updated_tasks": [
+            "NET-WP-0020-T05",
+            "NK-WP-0001-T01",
+            "NK-WP-0001-T02",
+            "NK-WP-0001-T03",
+            "NK-WP-0001-T04",
+            "NK-WP-0001-T05",
+            "NK-WP-0001-T06",
+            "NK-WP-0001-T07",
+            "NK-WP-0001-T08",
+            "NK-WP-0002-T01",
+            "NK-WP-0002-T02",
+            "NK-WP-0002-T03",
+            "NK-WP-0002-T04",
+            "NK-WP-0005-T02",
+            "NK-WP-0005-T03",
+            "NK-WP-0005-T04",
+            "NK-WP-0005-T06",
+            "NK-WP-0005-T07",
+            "NK-WP-0006-T1",
+            "NK-WP-0006-T2",
+            "NK-WP-0006-T3",
+            "NK-WP-0006-T4",
+            "NK-WP-0006-T5",
+            "NK-WP-0006-T6",
+            "NK-WP-0007-T1",
+            "NK-WP-0007-T2",
+            "NK-WP-0007-T3",
+            "NK-WP-0007-T4",
+            "NK-WP-0007-T5",
+            "NK-WP-0009-T01",
+            "NK-WP-0009-T02",
+            "NK-WP-0009-T03",
+            "NK-WP-0009-T04",
+            "NK-WP-0009-T05",
+            "NK-WP-0011-T01",
+            "NK-WP-0011-T02",
+            "NK-WP-0011-T03",
+            "NK-WP-0011-T04",
+            "NK-WP-0011-T05",
+            "NK-WP-0011-T06",
+            "NK-WP-0011-T07",
+            "NK-WP-0012-T1",
+            "NK-WP-0012-T2",
+            "NK-WP-0012-T3",
+            "NK-WP-0012-T4",
+            "NK-WP-0012-T5",
+            "NK-WP-0013-T1",
+            "NK-WP-0013-T2",
+            "NK-WP-0013-T3",
+            "NK-WP-0013-T4",
+            "NK-WP-0013-T5",
+            "NK-WP-0014-T1",
+            "NK-WP-0014-T2",
+            "NK-WP-0014-T3",
+            "NK-WP-0014-T4",
+            "NK-WP-0014-T5",
+            "NK-WP-0015-T1",
+            "NK-WP-0015-T2",
+            "NK-WP-0015-T3",
+            "NK-WP-0015-T4",
+            "NK-WP-0015-T5",
+            "NK-WP-0015-T6",
+            "NK-WP-0016-T1",
+            "NK-WP-0016-T2",
+            "NK-WP-0016-T3",
+            "NK-WP-0016-T4",
+            "NK-WP-0016-T5",
+            "NK-WP-0016-T6",
+            "NK-WP-0017-T1",
+            "NK-WP-0017-T2",
+            "NK-WP-0017-T3",
+            "NK-WP-0017-T4",
+            "NK-WP-0017-T5",
+            "NK-WP-0017-T6",
+            "NK-WP-0018-T1",
+            "NK-WP-0018-T2",
+            "NK-WP-0018-T3",
+            "NK-WP-0018-T4",
+            "NK-WP-0018-T5",
+            "NK-WP-0018-T6",
+            "NK-WP-0019-T1",
+            "NK-WP-0019-T2",
+            "NK-WP-0019-T3",
+            "NK-WP-0019-T4",
+            "NK-WP-0019-T5",
+            "NK-WP-0019-T6",
+            "NK-WP-0021-T01",
+            "NK-WP-0021-T02",
+            "NK-WP-0021-T03",
+            "NK-WP-0021-T04",
+            "NK-WP-0021-T05",
+            "NK-WP-0026-T01",
+            "NK-WP-0033-T05",
+            "NK-WP-0035-T01",
+            "NK-WP-0035-T02",
+            "NK-WP-0035-T03",
+            "NK-WP-0035-T04",
+            "NK-WP-0035-T05"
+          ],
+          "cancelled_tasks": [],
+          "refused": [],
+          "notes": []
+        }
+      }
+    },
+    {
+      "repo": "key-cape",
+      "commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
+      "method": "rmgr sync --push",
+      "receipt": {
+        "schema": "state-hub.repository-projection-reconcile.v1",
+        "instance_role": "primary",
+        "instance_label": "railiance01",
+        "expected_commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
+        "derived_commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
+        "outcome": {
+          "schema": "state-hub.projection-reset.v1",
+          "repo_slug": "key-cape",
+          "commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
+          "status": "applied",
+          "counts": {
+            "created": 0,
+            "updated": 29,
+            "retired": 0,
+            "refused": 0,
+            "released": 0,
+            "created_tasks": 0,
+            "updated_tasks": 13,
+            "cancelled_tasks": 0
+          },
+          "created": [],
+          "updated": [
+            "ADHOC-2026-09-05",
+            "ADHOC-2026-09-07",
+            "KEY-WP-0001",
+            "KEY-WP-0002",
+            "KEY-WP-0003",
+            "KEY-WP-0004",
+            "KEY-WP-0005",
+            "KEY-WP-0006",
+            "KEY-WP-0007",
+            "KEY-WP-0008",
+            "KEY-WP-0009",
+            "KEY-WP-0010",
+            "KEY-WP-0011",
+            "KEY-WP-0012",
+            "KEY-WP-0013",
+            "KEY-WP-0014",
+            "KEY-WP-0015",
+            "KEY-WP-0016",
+            "KEY-WP-0017",
+            "KEY-WP-0018",
+            "KEY-WP-0019",
+            "KEY-WP-0020",
+            "KEY-WP-0021",
+            "KEY-WP-0022",
+            "KEY-WP-0023",
+            "KEY-WP-0024",
+            "KEY-WP-0025",
+            "KEY-WP-0026",
+            "KEY-WP-0027"
+          ],
+          "retired": [],
+          "released": [],
+          "created_tasks": [],
+          "updated_tasks": [
+            "KEY-WP-0001-T04",
+            "KEY-WP-0001-T09",
+            "KEY-WP-0001-T12",
+            "KEY-WP-0001-T14",
+            "KEY-WP-0001-T17",
+            "KEY-WP-0001-T21",
+            "KEY-WP-0001-T23",
+            "KEY-WP-0002-T01",
+            "KEY-WP-0002-T02",
+            "KEY-WP-0002-T03",
+            "KEY-WP-0002-T04",
+            "KEY-WP-0002-T06",
+            "KEY-WP-0013-T02"
+          ],
+          "cancelled_tasks": [],
+          "refused": [],
+          "notes": []
+        }
+      }
+    },
+    {
+      "repo": "railiance-platform",
+      "commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
+      "method": "rmgr sync --push",
+      "receipt": {
+        "schema": "state-hub.repository-projection-reconcile.v1",
+        "instance_role": "primary",
+        "instance_label": "railiance01",
+        "expected_commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
+        "derived_commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
+        "outcome": {
+          "schema": "state-hub.projection-reset.v1",
+          "repo_slug": "railiance-platform",
+          "commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
+          "status": "applied",
+          "counts": {
+            "created": 0,
+            "updated": 41,
+            "retired": 0,
+            "refused": 0,
+            "released": 0,
+            "created_tasks": 0,
+            "updated_tasks": 1,
+            "cancelled_tasks": 0
+          },
+          "created": [],
+          "updated": [
+            "RAIL-PL-WP-0001",
+            "RAIL-PL-WP-0002",
+            "RPF-WP-0001",
+            "RPF-WP-0002",
+            "RPF-WP-0003",
+            "RPF-WP-0004",
+            "RPF-WP-0005",
+            "RPF-WP-0006",
+            "RPF-WP-0007",
+            "RPF-WP-0008",
+            "RPF-WP-0009",
+            "RPF-WP-0010",
+            "RPF-WP-0011",
+            "RPF-WP-0012",
+            "RPF-WP-0013",
+            "RPF-WP-0014",
+            "RPF-WP-0015",
+            "RPF-WP-0016",
+            "RPF-WP-0017",
+            "RPF-WP-0018",
+            "RPF-WP-0019",
+            "RPF-WP-0020",
+            "RPF-WP-0021",
+            "RPF-WP-0022",
+            "RPF-WP-0023",
+            "RPF-WP-0024",
+            "RPF-WP-0025",
+            "RPF-WP-0026",
+            "RPF-WP-0027",
+            "RPF-WP-0028",
+            "RPF-WP-0029",
+            "RPF-WP-0030",
+            "RPF-WP-0031",
+            "RPF-WP-0032",
+            "RPF-WP-0033",
+            "RPF-WP-0034",
+            "RPF-WP-0035",
+            "RPF-WP-0036",
+            "RPF-WP-0037",
+            "RPF-WP-0038",
+            "RPF-WP-ADHOC-2026-08-23"
+          ],
+          "retired": [],
+          "released": [],
+          "created_tasks": [],
+          "updated_tasks": [
+            "RPF-WP-0035-T05"
+          ],
+          "cancelled_tasks": [],
+          "refused": [],
+          "notes": []
+        }
+      }
+    },
+    {
+      "repo": "prj-helixforge-factory",
+      "commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
+      "method": "rmgr sync --push",
+      "receipt": {
+        "schema": "state-hub.repository-projection-reconcile.v1",
+        "instance_role": "primary",
+        "instance_label": "railiance01",
+        "expected_commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
+        "derived_commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
+        "outcome": {
+          "schema": "state-hub.projection-reset.v1",
+          "repo_slug": "prj-helixforge-factory",
+          "commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
+          "status": "applied",
+          "counts": {
+            "created": 0,
+            "updated": 1,
+            "retired": 0,
+            "refused": 0,
+            "released": 0,
+            "created_tasks": 0,
+            "updated_tasks": 0,
+            "cancelled_tasks": 0
+          },
+          "created": [],
+          "updated": [
+            "HFACT-WP-0001"
+          ],
+          "retired": [],
+          "released": [],
+          "created_tasks": [],
+          "updated_tasks": [],
+          "cancelled_tasks": [],
+          "refused": [],
+          "notes": []
+        }
+      }
+    }
+  ],
+  "scoped_retirement": {
+    "source_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+    "duplicate_uuid": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0",
+    "duplicate_status": "archived",
+    "history_preserved": true,
+    "canonical_uuid": "04685f94-1991-5e62-80d2-5669913e99fc",
+    "canonical_status": "blocked",
+    "canonical_handoff_status": "wait",
+    "retired_only_reviewed_duplicate": true,
+    "cli_limitation": "rmgr uses the same Idempotency-Key for different acknowledgement payloads at one commit; the retry returned HTTP 409.",
+    "execution": "Same supported primary reconciliation endpoint, distinct idempotency key for each distinct payload after explicit sole-refusal recheck.",
+    "receipt": {
+      "schema": "state-hub.repository-projection-reconcile.v1",
+      "instance_role": "primary",
+      "instance_label": "railiance01",
+      "expected_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+      "derived_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+      "outcome": {
+        "schema": "state-hub.projection-reset.v1",
+        "repo_slug": "net-kingdom",
+        "commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+        "status": "applied",
+        "counts": {
+          "created": 0,
+          "updated": 44,
+          "retired": 1,
+          "refused": 0,
+          "released": 0,
+          "created_tasks": 0,
+          "updated_tasks": 98,
+          "cancelled_tasks": 0
+        },
+        "created": [],
+        "updated": [
+          "NET-WP-0015",
+          "NET-WP-0016",
+          "NET-WP-0017",
+          "NET-WP-0018",
+          "NET-WP-0019",
+          "NET-WP-0020",
+          "NK-WP-0001",
+          "NK-WP-0002",
+          "NK-WP-0003",
+          "NK-WP-0004",
+          "NK-WP-0005",
+          "NK-WP-0006",
+          "NK-WP-0007",
+          "NK-WP-0008",
+          "NK-WP-0009",
+          "NK-WP-0010",
+          "NK-WP-0011",
+          "NK-WP-0012",
+          "NK-WP-0013",
+          "NK-WP-0014",
+          "NK-WP-0015",
+          "NK-WP-0016",
+          "NK-WP-0017",
+          "NK-WP-0018",
+          "NK-WP-0019",
+          "NK-WP-0021",
+          "NK-WP-0022",
+          "NK-WP-0023",
+          "NK-WP-0024",
+          "NK-WP-0025",
+          "NK-WP-0026",
+          "NK-WP-0027",
+          "NK-WP-0028",
+          "NK-WP-0029",
+          "NK-WP-0030",
+          "NK-WP-0031",
+          "NK-WP-0032",
+          "NK-WP-0033",
+          "NK-WP-0034",
+          "NK-WP-0035",
+          "NK-WP-ADHOC-2026-06-14",
+          "NK-WP-ADHOC-2026-07-02",
+          "NK-WP-ADHOC-2026-08-14",
+          "NK-WP-ADHOC-2026-08-23"
+        ],
+        "retired": [
+          "nk-wp-0035"
+        ],
+        "released": [],
+        "created_tasks": [],
+        "updated_tasks": [
+          "NET-WP-0020-T05",
+          "NK-WP-0001-T01",
+          "NK-WP-0001-T02",
+          "NK-WP-0001-T03",
+          "NK-WP-0001-T04",
+          "NK-WP-0001-T05",
+          "NK-WP-0001-T06",
+          "NK-WP-0001-T07",
+          "NK-WP-0001-T08",
+          "NK-WP-0002-T01",
+          "NK-WP-0002-T02",
+          "NK-WP-0002-T03",
+          "NK-WP-0002-T04",
+          "NK-WP-0005-T02",
+          "NK-WP-0005-T03",
+          "NK-WP-0005-T04",
+          "NK-WP-0005-T06",
+          "NK-WP-0005-T07",
+          "NK-WP-0006-T1",
+          "NK-WP-0006-T2",
+          "NK-WP-0006-T3",
+          "NK-WP-0006-T4",
+          "NK-WP-0006-T5",
+          "NK-WP-0006-T6",
+          "NK-WP-0007-T1",
+          "NK-WP-0007-T2",
+          "NK-WP-0007-T3",
+          "NK-WP-0007-T4",
+          "NK-WP-0007-T5",
+          "NK-WP-0009-T01",
+          "NK-WP-0009-T02",
+          "NK-WP-0009-T03",
+          "NK-WP-0009-T04",
+          "NK-WP-0009-T05",
+          "NK-WP-0011-T01",
+          "NK-WP-0011-T02",
+          "NK-WP-0011-T03",
+          "NK-WP-0011-T04",
+          "NK-WP-0011-T05",
+          "NK-WP-0011-T06",
+          "NK-WP-0011-T07",
+          "NK-WP-0012-T1",
+          "NK-WP-0012-T2",
+          "NK-WP-0012-T3",
+          "NK-WP-0012-T4",
+          "NK-WP-0012-T5",
+          "NK-WP-0013-T1",
+          "NK-WP-0013-T2",
+          "NK-WP-0013-T3",
+          "NK-WP-0013-T4",
+          "NK-WP-0013-T5",
+          "NK-WP-0014-T1",
+          "NK-WP-0014-T2",
+          "NK-WP-0014-T3",
+          "NK-WP-0014-T4",
+          "NK-WP-0014-T5",
+          "NK-WP-0015-T1",
+          "NK-WP-0015-T2",
+          "NK-WP-0015-T3",
+          "NK-WP-0015-T4",
+          "NK-WP-0015-T5",
+          "NK-WP-0015-T6",
+          "NK-WP-0016-T1",
+          "NK-WP-0016-T2",
+          "NK-WP-0016-T3",
+          "NK-WP-0016-T4",
+          "NK-WP-0016-T5",
+          "NK-WP-0016-T6",
+          "NK-WP-0017-T1",
+          "NK-WP-0017-T2",
+          "NK-WP-0017-T3",
+          "NK-WP-0017-T4",
+          "NK-WP-0017-T5",
+          "NK-WP-0017-T6",
+          "NK-WP-0018-T1",
+          "NK-WP-0018-T2",
+          "NK-WP-0018-T3",
+          "NK-WP-0018-T4",
+          "NK-WP-0018-T5",
+          "NK-WP-0018-T6",
+          "NK-WP-0019-T1",
+          "NK-WP-0019-T2",
+          "NK-WP-0019-T3",
+          "NK-WP-0019-T4",
+          "NK-WP-0019-T5",
+          "NK-WP-0019-T6",
+          "NK-WP-0021-T01",
+          "NK-WP-0021-T02",
+          "NK-WP-0021-T03",
+          "NK-WP-0021-T04",
+          "NK-WP-0021-T05",
+          "NK-WP-0026-T01",
+          "NK-WP-0033-T05",
+          "NK-WP-0035-T01",
+          "NK-WP-0035-T02",
+          "NK-WP-0035-T03",
+          "NK-WP-0035-T04",
+          "NK-WP-0035-T05"
+        ],
+        "cancelled_tasks": [],
+        "refused": [],
+        "notes": []
+      }
+    }
+  },
+  "final_closeout": {
+    "recorded_at": "2026-09-08T22:57:10.042009+00:00",
+    "task_readbacks": [
+      {
+        "task": "KEY-WP-0013-T02",
+        "uuid": "607897c5-bad9-55e5-86df-7802f592d6e8",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": null,
+        "description_sha256": "38eca245b19f3d09e6b37b40237dbc7a3b91bb1d90f423e67c1979b81293f621",
+        "repaired_fields_after_reconcile": [
+          "description"
+        ],
+        "verified": true
+      },
+      {
+        "task": "RPF-WP-0035-T05",
+        "uuid": "e15d62c9-e5da-5721-a135-87c050f7851c",
+        "status": "wait",
+        "needs_human": true,
+        "intervention_note": "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved.",
+        "blocking_reason": null,
+        "description_sha256": "1f9246f761f3aee40cfb738be53ff42945908dce6de8fcefe4ec50fc34335a7d",
+        "repaired_fields_after_reconcile": [
+          "description"
+        ],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T01",
+        "uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.",
+        "description_sha256": "d01f4c980546d357572faccef5f1b628654db61ab394acbcb914fdbdfc560eba",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T02",
+        "uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85",
+        "status": "progress",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": null,
+        "description_sha256": "4bf22f0a3d2e51f148c1633df03e6ef2a9d90cc1d3683875d9716228604e9798",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T03",
+        "uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": "",
+        "blocking_reason": "Actual signed upstream issuer proved and exact configuration pin verified at Secret revision 58713343. RPF-WP-0035-T05 owns the named pending CCR-2026-0017/0018 reviews; attended custody/compatible rollout and separate audit/client-side/native delivery remain.",
+        "description_sha256": "7706695faceca2e8c1fa5dcd67a4d3d3c980b6f10a56b4f7ff89696300aa1c2b",
+        "repaired_fields_after_reconcile": [
+          "intervention_note"
+        ],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T04",
+        "uuid": "1054b135-f367-57b1-9308-72a1fbb38f62",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement.",
+        "description_sha256": "2bde066a96176fcdf73b4ca77c7665fa1bd6e083dd6d47d2123b3bdd1f7fe467",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T05",
+        "uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04.",
+        "description_sha256": "4b9e0535a9563d1583e33619d3291bcf68b2c68082ae69b3964636f20ca16315",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T06",
+        "uuid": "4d72717a-d5c9-571d-987b-9373f01253fa",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": "Await the current governed Railiance worker proof in T05.",
+        "description_sha256": "aedb7c3030499c63df9cc522a06c6fa8c43125f1e4f900dc858b31488a056aa0",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T07",
+        "uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration.",
+        "description_sha256": "f9730567f0939057764335526ed1ba4d09f21ace1a3ddf28524d622c16f6d23f",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      },
+      {
+        "task": "HFACT-WP-0001-T08",
+        "uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678",
+        "status": "wait",
+        "needs_human": false,
+        "intervention_note": null,
+        "blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window.",
+        "description_sha256": "f801d06c2925350df6471287a731b90928424431308a9387131480ff314a0b85",
+        "repaired_fields_after_reconcile": [],
+        "verified": true
+      }
+    ],
+    "pending_reviews": [
+      {
+        "ccr": "CCR-2026-0017",
+        "source": "credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml",
+        "decision_id": "b533a271-b704-4c5c-98a2-9a5951aadfb6",
+        "status": "open",
+        "required_approvers": [
+          "platform-operator",
+          "key-cape-owner"
+        ],
+        "readback_verified": true
+      },
+      {
+        "ccr": "CCR-2026-0018",
+        "source": "credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml",
+        "decision_id": "efa90517-0cae-4eb6-a68d-5b0489c84d65",
+        "status": "open",
+        "required_approvers": [
+          "platform-operator",
+          "key-cape-owner"
+        ],
+        "readback_verified": true
+      }
+    ],
+    "repositories": [
+      {
+        "repo": "net-kingdom",
+        "commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+        "remote_main_matches": true,
+        "clean": true
+      },
+      {
+        "repo": "key-cape",
+        "commit": "cf23469ead867966fbf21e732b4c8c7bea337b3b",
+        "remote_main_matches": true,
+        "clean": true
+      },
+      {
+        "repo": "railiance-platform",
+        "commit": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
+        "remote_main_matches": true,
+        "clean": true
+      },
+      {
+        "repo": "prj-helixforge-factory",
+        "commit": "53051c98f670e16035ca9f687afcfa9f5544ee80",
+        "remote_main_matches": true,
+        "clean": true
+      }
+    ],
+    "consistency_checks": [
+      {
+        "repo": "key-cape",
+        "command": "statehub fix-consistency --no-writeback --json",
+        "summary": {
+          "fail": 0,
+          "automation_error": 0,
+          "warn": 13,
+          "info": 1
+        },
+        "result": "warn"
+      },
+      {
+        "repo": "prj-helixforge-factory",
+        "command": "statehub fix-consistency --no-writeback --json",
+        "summary": {
+          "fail": 0,
+          "automation_error": 0,
+          "warn": 2,
+          "info": 0
+        },
+        "result": "warn"
+      }
+    ],
+    "progress": [
+      {
+        "label": "net-kingdom",
+        "id": "9f6c31d5-213a-4269-81a5-febd6fdeb2ff",
+        "workplan_id": null,
+        "task_id": null
+      },
+      {
+        "label": "key-cape",
+        "id": "d9f6e931-5b71-41db-a07d-060c3d95267c",
+        "workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f",
+        "task_id": "607897c5-bad9-55e5-86df-7802f592d6e8"
+      },
+      {
+        "label": "railiance-platform",
+        "id": "d107f7dd-3db0-460c-92ac-e3b5284ec84f",
+        "workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
+        "task_id": "e15d62c9-e5da-5721-a135-87c050f7851c"
+      },
+      {
+        "label": "factory-identity",
+        "id": "d403dd34-f406-48f2-b280-38a86afec51e",
+        "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
+        "task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823"
+      },
+      {
+        "label": "factory-hygiene",
+        "id": "68918c02-e288-420e-b195-4fa20e6466bc",
+        "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
+        "task_id": "3a3a967d-5bec-52ee-be20-dc94524b8e85"
+      },
+      {
+        "label": "custodian",
+        "id": "21069d35-a6a6-42ad-bc34-a6f1a03cb38e",
+        "workplan_id": null,
+        "task_id": null
+      }
+    ],
+    "human_needed_count": 16
+  },
+  "remaining_owner_records": {
+    "RPF-WP-0035-T05": "Two named custody reviews and completion/exercise of the contained first-provision procedure before the attended activation window.",
+    "KEY-WP-0013-T02": "Admitted custody, compatible config/image rollout, service-client positive/negative checks and existing-human-login regression.",
+    "HFACT-WP-0001-T02": "Repo Manager acknowledgement retry must bind idempotency key to request semantics; source/Hub field parity remains a checked limitation.",
+    "HFACT-WP-0001-T03": "Consume live custody/identity/approval/audit/client-side/native delivery for the exact factory proof tuple."
+  }
+}
diff --git a/docs/assessments/2026-09-09-helixforge-issuer-pin.md b/docs/assessments/2026-09-09-helixforge-issuer-pin.md
new file mode 100644
index 0000000..b180cde
--- /dev/null
+++ b/docs/assessments/2026-09-09-helixforge-issuer-pin.md
@@ -0,0 +1,61 @@
+# HelixForge critical path: issuer pin complete, custody reviews ready
+
+NetKingdom completed the stored upstream issuer prerequisite on 2026-09-09
+(2026-09-08T22:23:58Z). Its live configuration was missing `authelia.issuer`;
+the contained owner helper inserted the independently verified
+`https://auth.coulomb.social` value and read it back successfully.
+
+The Secret UID stayed the same and its resourceVersion advanced from `51346058`
+to `58713343`. Atomic UID/revision preconditions prevented a stale write. Every
+other configuration byte and Secret data entry, including the signing key, was
+preserved. The Deployment stayed at generation 29, image `main-153258b`, with
+one ready and available replica. No credential value entered output or evidence.
+
+The owner implementation extends the existing configuration helper with two
+issuer-only modes; its legacy client/LLDAP patch mode was not used. All thirteen
+tests passed, including concurrency, byte preservation and error containment.
+The read and write procedures are both exercised against the actual target.
+[Owner procedure](/home/worsch/net-kingdom/docs/keycape-upstream-issuer-pin.md).
+
+This closes one concrete prerequisite inside KEY-WP-0013-T02 and
+HFACT-WP-0001-T03. Those tasks still wait for custody and the compatible
+image/configuration rollout. A stored pin does not prove that the existing
+process reloaded it or that downstream login regression has passed.
+
+The next human dependency is now actionable in its existing owner record,
+RPF-WP-0035-T05. Both existing CCRs have pending review decisions:
+
+| Request | Pending decision | Required reviewers |
+| --- | --- | --- |
+| CCR-2026-0017 | `b533a271-b704-4c5c-98a2-9a5951aadfb6` | platform-operator, key-cape-owner |
+| CCR-2026-0018 | `efa90517-0cae-4eb6-a68d-5b0489c84d65` | platform-operator, key-cape-owner |
+
+[The review packet](/home/worsch/railiance-platform/docs/credential-lane-designs/keycape-approval-clients-review.md)
+sets out the exact paths, two separate policies/roles/stores, namespace and
+service-account binding, TTL, risks and excluded capabilities. Both CCRs validate
+and their generated policies match source. Both still refuse `apply-plan`
+because they are proposed. No owner review, custody activation or client-side
+credential access has been inferred from the user's continuation instruction.
+
+The generated plans still leave initial secret provisioning to a contained
+owner procedure. That procedure must be completed and exercised before the
+attended activation window; a successful capabilities preflight does not establish
+that it is ready. This remaining work stays with RPF-WP-0035-T05 and the linked
+KeyCape rollout, alongside their existing rollback and live acceptance duties.
+
+Efficiency has improved in two concrete ways: the issuer pin no longer requires
+manual configuration reconstruction, and the custody review is now a pair of
+linked decisions owned by one task instead of an unstructured cross-repository
+wait. No elapsed-time saving or factory throughput result is claimed. The
+fourteen-day operating observation remains unstarted.
+
+Final synchronization also cleared the sole already owner-archived NetKingdom
+duplicate after a [scoped review](2026-09-09-netkingdom-projection-review.json).
+Its history remains readable, and the canonical profile handoff remains waiting.
+Repo Manager's acknowledgement retry reused an idempotency key with a changed
+payload and received HTTP 409. The supported primary endpoint completed the
+reviewed operation using distinct request keys. HFACT-WP-0001-T02 retains the
+CLI fix and regression test; this receipt does not claim that defect is fixed.
+
+[Execution, synchronization and progress receipt](2026-09-09-helixforge-issuer-pin.json)
+contains the live evidence, published owner revisions and final Hub readbacks.
diff --git a/docs/assessments/2026-09-09-netkingdom-projection-review.json b/docs/assessments/2026-09-09-netkingdom-projection-review.json
new file mode 100644
index 0000000..b077640
--- /dev/null
+++ b/docs/assessments/2026-09-09-netkingdom-projection-review.json
@@ -0,0 +1,27 @@
+{
+  "schema": "custodian.scoped-projection-retirement-review.v1",
+  "reviewed_by": "codex",
+  "owner_task": "HFACT-WP-0001-T02",
+  "repo": "net-kingdom",
+  "expected_commit": "896c1200c0f387cd331ceca11cb6a6586ac815eb",
+  "target": {
+    "uuid": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0",
+    "slug": "nk-wp-0035",
+    "status": "archived",
+    "backing_relative_path": "workplans/NK-WP-0035-emission-cadence-security-profile.md",
+    "prior_owner_disposition": "Hub description records owner-approved archival on 2026-09-07: forbidden hand-registration duplicated the canonical source-derived record, with nothing unique retained here.",
+    "task_statuses": ["done", "done", "cancel", "done"]
+  },
+  "canonical_record": {
+    "uuid": "04685f94-1991-5e62-80d2-5669913e99fc",
+    "source_id": "NK-WP-0035",
+    "status": "blocked",
+    "retained_open_task_uuid": "e3fbc8b8-00d5-57ce-ba0c-19b58044c950",
+    "retained_open_task_status": "wait"
+  },
+  "operation": "Reconcile the exact published repository and acknowledge only the already archived duplicate after confirming it is the sole retirement refusal.",
+  "implementation_review": "state-hub/api/services/forge_projection.py marks projection_retired_at, records the reason and tombstones the stale slug. It does not delete the old workplan or task history.",
+  "abort": "Any different source commit, additional retirement refusal, changed duplicate disposition, nonterminal duplicate task or missing canonical waiting task.",
+  "acceptance": "Applied exact-commit primary receipt retires only nk-wp-0035; canonical workplan remains blocked and canonical handoff remains wait; old record and four terminal tasks remain readable.",
+  "execution_status": "reviewed_before_execution"
+}