diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json
index 50e073c..6b798b5 100644
--- a/.kaizen/agents/custodian-codex/supervision.json
+++ b/.kaizen/agents/custodian-codex/supervision.json
@@ -828,8 +828,8 @@
     },
     {
       "proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
-      "disposition": "pending",
-      "outcome": "not_executed",
+      "disposition": "accepted_revised",
+      "outcome": "succeeded",
       "proposal_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/proposal-metadata.json",
       "original_revision": 1,
       "original_digest_sha256": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932",
@@ -838,18 +838,18 @@
       "current_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
       "target": "railiance01/92.205.62.239 state-hub release API/MCP and exact-new-trial migration Job",
       "expected_result": "New API binding guard delivered and current-baseline native/whole-pipeline preservation verified, with earlier parent mismatch retained as explicit exception.",
-      "verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md",
+      "verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json",
       "rollback_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/RECOVERY.md",
       "cost_estimate_eur": null,
       "risk_estimate_eur": null,
       "cost_estimate": "Unpriced incremental execution and recovery costs on existing infrastructure.",
       "risk_estimate": "Unpriced coordination outage, hook lifetime, lock mapping and recovery; reviewed conditional limits stop for attended owner on unknown state.",
       "supervisor": "Bernd Worsch",
-      "approval_ref": null,
-      "approved_revision": null,
-      "approved_digest_sha256": null,
-      "executed_revision": null,
-      "executed_digest_sha256": null,
+      "approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
+      "approved_revision": 2,
+      "approved_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
+      "executed_revision": 2,
+      "executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
       "refinement_or_rescue": true,
       "promotion_evidence": false,
       "related_proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1",
@@ -867,7 +867,17 @@
           "outcome": "not_executed",
           "refinement": "Typed module/SHA256 records; unchanged runtime and probe logic."
         }
-      ]
+      ],
+      "approved_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
+      "approved_at": "2026-10-17T01:51:27.526327+00:00",
+      "approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json",
+      "approval_scope": "Exact revision2 new API image rollout, eight rollback/intercepted probes, corrected normal pipeline and current-baseline exception, plus scoped conditional recovery; no authority promotion.",
+      "executed_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
+      "execution_started_at": "2026-10-17T01:52:59.649596+00:00",
+      "execution_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json",
+      "verified_at": "2026-10-17T01:55:19.742775+00:00",
+      "verified_outcome": "Exactapprovedrevision2 deliveredHelm77; eightactualrollback/interceptedcasespass, all18CURRENTfullrows equalafterrolloutandnormalpipeline; archives/stagedworkpreserved. Originalthreeparentfailure retainedasfounder-approvedhistoricalexception, notrestored/backfilled.",
+      "recovery_required": false
     }
   ],
   "trials": [
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json
new file mode 100644
index 0000000..2f8b186
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json
@@ -0,0 +1,18 @@
+{
+  "workplan_id": "79579572-8120-5d3b-aca5-dd4aff60d058",
+  "id": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
+  "topic_id": null,
+  "title": "Review exact frozen-binding API guard successor and retained baseline exception",
+  "description": "Pending proposal STATE-WP-0095-T10-frozen-bindings-guard-r1 revision2 SHA2565d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e. Image main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1; frozen chart b5c0663d830fc8d3b65080f237a0be8d01f8b2f7fec9dc33aeba91b1b6b281d4. Eight-identity image-only server dry-run and explicit target/headroom/schema pass. Verified installed checker maintenance preserves all18 CURRENT rows; prior three-parent hash failures remain historical exceptions, never restored or backfilled. Requested ADMINISTER @ realm:kubernetes/railiance01 activation=APPROVED includes exact new Job conditional recovery, rollback76 after verified quiescence, current-baseline successor acceptance, unpriced cost/risk and attended stop for unknown mapping. Full review: the-custodian/docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md. No new runtime is approved or executed. Original revision1 remains retained and unexecuted. Revision2 only represents source hashes as typed metadata after the normal scanner false positive; runtime, case logic, acceptance and recovery scope are unchanged.",
+  "decision_type": "made",
+  "status": "resolved",
+  "rationale": "Founder replied \"go ahead\" to the exact revision2 API guard deployment review, including current-baseline exception and conditional recovery. Approved STATE-WP-0095-T10-frozen-bindings-guard-r1 revision2 SHA256 5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e. ADMINISTER @ realm:kubernetes/railiance01 activation=APPROVED. Exact pinned image, frozen chart, acceptance and recovery scope as reviewed; no autopilot or credential grant.",
+  "decided_by": "Bernd Worsch",
+  "decided_at": "2026-10-17T01:51:27.526327Z",
+  "deadline": null,
+  "escalation_note": null,
+  "superseded_by": null,
+  "created_at": "2026-10-17T00:37:26.205185Z",
+  "updated_at": "2026-10-17T01:51:27.812490Z",
+  "workstream_id": "79579572-8120-5d3b-aca5-dd4aff60d058"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/check_live.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/check_live.py
new file mode 100644
index 0000000..841d8e8
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/check_live.py
@@ -0,0 +1,105 @@
+"""Approved trial's bounded metadata reads, dry-run and private hash/probe calls."""
+from pathlib import Path
+import argparse
+import datetime
+import hashlib
+import json
+import os
+import shlex
+import subprocess
+import urllib.request
+
+BASE = Path(__file__).resolve().parent
+REVIEW = BASE.parent / 'guard-successor-review-r2'
+OLD = 'forgejo.coulomb.social/coulomb/state-hub:main-51bc70d@sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015'
+NEW = 'forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1'
+SNAPSHOT = BASE.parent.parent / 'netkingdom-target-2026-10-16/cluster-historical-publication-r1/postdeployment-verifier-r1/snapshot_full_row_hashes.py'
+
+def save(name, data):
+    (BASE / (name + '.json')).write_text(json.dumps(data, indent=2) + '\n')
+
+def remote(args, content=None):
+    p = subprocess.run(['ssh', 'railiance01', 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml ' + shlex.join(args)],
+                       input=content, capture_output=True, text=True, timeout=50)
+    assert p.returncode == 0, 'private-owner-command-refused'
+    return json.loads(p.stdout) if p.stdout.strip() else None
+
+def runtime(after):
+    image = NEW if after else OLD
+    nodes = remote(['kubectl', 'get', 'nodes', '-o', 'json'])
+    assert any(a['address'] == '92.205.62.239' for n in nodes['items'] for a in n['status']['addresses'])
+    status = remote(['helm', '-n', 'state-hub', 'status', 'state-hub', '-o', 'json'])
+    assert status['version'] == (77 if after else 76) and status['info']['status'] == 'deployed'
+    assert remote(['kubectl', '-n', 'state-hub', 'get', 'job', 'state-hub-migrate', '--ignore-not-found', '-o', 'json']) is None
+    assert not remote(['kubectl', '-n', 'state-hub', 'get', 'pods', '-l', 'job-name=state-hub-migrate', '-o', 'json'])['items']
+    checked = []
+    api = None
+    for name in ['state-hub', 'state-hub-mcp']:
+        d = remote(['kubectl', '-n', 'state-hub', 'get', 'deployment', name, '-o', 'json'])
+        assert d['status']['observedGeneration'] == d['metadata']['generation']
+        assert d['status'].get('readyReplicas') == d['spec']['replicas'] == 1
+        assert [c['image'] for c in d['spec']['template']['spec']['containers']] == [image]
+        selector = ','.join(k+'='+v for k,v in sorted(d['spec']['selector']['matchLabels'].items()))
+        pods = remote(['kubectl', '-n', 'state-hub', 'get', 'pods', '-l', selector, '-o', 'json'])
+        active = [p for p in pods['items'] if not p['metadata'].get('deletionTimestamp')]
+        assert len(active) == 1
+        p = active[0]
+        assert any(c['type'] == 'Ready' and c['status'] == 'True' for c in p['status']['conditions'])
+        assert all(c['ready'] and c['imageID'].endswith(image.split('@')[1]) for c in p['status']['containerStatuses'])
+        identity = {'name': p['metadata']['name'], 'uid': p['metadata']['uid']}
+        checked.append({'deployment': name, 'ready': True, 'image': image, 'pod': identity})
+        if name == 'state-hub':
+            api = identity
+    health = json.load(urllib.request.urlopen('http://127.0.0.1:8000/state/health', timeout=20))
+    assert health['status'] == 'ok' and health['instance_role'] == 'primary' and health['instance_label'] == 'railiance01'
+    assert health['schema']['applied'] == health['schema']['expected'] == 'c4d5e6f7a8b9'
+    result = {'status': 'verified', 'observed_at': datetime.datetime.now(datetime.timezone.utc).isoformat(),
+              'helm_revision': status['version'], 'target': 'railiance01/92.205.62.239',
+              'deployments': checked, 'api_pod': api, 'schema': health['schema'],
+              'migration_job_and_pods_absent': True, 'primary': 'primary/railiance01'}
+    save('runtime-after' if after else 'runtime-before', result)
+    return result
+
+def pod_command(after, helper):
+    state = json.loads((BASE / ('runtime-after.json' if after else 'runtime-before.json')).read_text())
+    pod = state['api_pod']
+    actual = remote(['kubectl', '-n', 'state-hub', 'get', 'pod', pod['name'], '-o', 'json'])
+    assert actual['metadata']['uid'] == pod['uid']
+    return remote(['kubectl', '-n', 'state-hub', 'exec', '-i', pod['name'], '-c', 'state-hub', '--', 'python', '-'], helper.read_text())
+
+parser = argparse.ArgumentParser()
+parser.add_argument('phase', choices=['preflight', 'delivered', 'before', 'after', 'post-pipeline', 'probes'])
+phase = parser.parse_args().phase
+if phase == 'preflight':
+    runtime(False)
+    env = {**os.environ, 'KUBECONFIG': '/home/worsch/.kube/config-railiance01'}
+    headroom = subprocess.run(['python3', '/home/worsch/state-hub/scripts/release_headroom_preflight.py'],
+                             capture_output=True, env=env, timeout=125)
+    report = json.loads(headroom.stdout)
+    save('fresh-headroom', report)
+    assert headroom.returncode == 0 and report['ok']
+    dry = subprocess.run(['python3', str(REVIEW / 'reuse_values_dryrun.py')], capture_output=True, timeout=160)
+    report = json.loads(dry.stdout)
+    save('fresh-server-dryrun', report)
+    assert dry.returncode == 0 and report['status'] == 'passed_images_only'
+    assert report['changed_object_count'] == 3 and len(report['objects']) == 8
+elif phase == 'delivered':
+    runtime(True)
+elif phase == 'probes':
+    helper = REVIEW / 'native_binding_probes.py'
+    assert hashlib.sha256(helper.read_bytes()).hexdigest() == 'ce492d0713c987e47eefc991a6312c1c63ed72056a597e9e28aee959d06e71d5'
+    report = pod_command(True, helper)
+    save('native-binding-probes', report)
+    assert report['status'] == 'passed' and len(report['cases']) == 8 and report['commits_performed'] == 0
+else:
+    assert hashlib.sha256(SNAPSHOT.read_bytes()).hexdigest() == 'f01e93c0fcb4ca155bdf76813626c33e4343f6a8caec2870ab1d785243c60479'
+    report = pod_command(phase != 'before', SNAPSHOT)
+    assert report['status'] == 'captured_readonly'
+    if phase != 'before':
+        original = json.loads((BASE / 'full-rows-before.json').read_text())
+        report['current_baseline_equal'] = report['tables'] == original['tables']
+        save('full-rows-' + phase, report)
+        assert report['current_baseline_equal']
+    else:
+        save('full-rows-before', report)
+print(json.dumps({'phase': phase, 'status': 'verified'}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/coordination-receipt.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/coordination-receipt.json
new file mode 100644
index 0000000..a389d71
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/coordination-receipt.json
@@ -0,0 +1,35 @@
+{
+  "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+  "id": "ad3a6ef1-1c42-4396-bab4-b89ff3ec8962",
+  "topic_id": null,
+  "task_id": null,
+  "decision_id": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
+  "event_type": "coordination_receipt",
+  "summary": "Frozen-binding guard successor and registrar return satisfied; native target gates remain separate.",
+  "detail": {
+    "state": "satisfied",
+    "flavor": "implementation",
+    "reason": "Founder approved exactrevision2; Helm77 exact4cc guard delivery, eight nativezero-commitcases and current18fullrow/normalpipeline pass. StateT10done publishedbb525 and RMGR19T06done/parentfinished published3bcb verified. Original3parentfailure retained as approved historicalexception; no native16gateclosure.",
+    "case_id": "cluster-frozen-binding-guard-successor-r1",
+    "observer": "codex",
+    "driver_repo": "prj-state-hub-retirement",
+    "next_action": "Retain actual runtime and source-owner receipts; independent native-owner waits remain live. No worker wake.",
+    "approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
+    "scenario_type": "project_driver",
+    "obligor_task_id": "STATE-WP-0095-T10",
+    "registrar_commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
+    "native_acceptance": false,
+    "driver_workplan_id": "SHR-WP-0001",
+    "beneficiary_task_id": "RMGR-WP-0019-T06",
+    "obligor_workplan_id": "STATE-WP-0095",
+    "coordination_context": "CUST-WP-0080",
+    "runtime_return_sha256": "09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a",
+    "human_gate_never_woken": true,
+    "beneficiary_workplan_id": "RMGR-WP-0019",
+    "runtime_worker_injection_enabled": false
+  },
+  "author": "codex",
+  "session_id": null,
+  "created_at": "2026-10-17T02:00:08.768238Z",
+  "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execute.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execute.py
new file mode 100644
index 0000000..d51d000
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execute.py
@@ -0,0 +1,75 @@
+"""Execute exactly the founder-approved revision2 rollout, with live observation."""
+from pathlib import Path
+import datetime
+import hashlib
+import json
+import shutil
+import subprocess
+import time
+
+BASE = Path(__file__).resolve().parent
+ROOT = BASE.parents[3]
+REVIEW = BASE.parent / 'guard-successor-review-r2'
+PIN = '5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e'
+proposal = REVIEW / 'proposal-metadata.json'
+assert hashlib.sha256(proposal.read_bytes()).hexdigest() == PIN
+meta = json.loads(proposal.read_text())
+for r in meta['bound_receipts']:
+    assert hashlib.sha256(Path(r['path']).read_bytes()).hexdigest() == r['sha256']
+approval = json.loads((BASE / 'approval-decision.json').read_text())
+assert approval['status'] == 'resolved' and approval['decision_type'] == 'made'
+assert PIN in approval['rationale']
+before = json.loads((BASE / 'full-rows-before.json').read_text())
+prior = json.loads((BASE.parent / 'rollout-close-current-full-row-hashes.json').read_text())
+assert before['tables'] == prior['tables'], 'unexpected-preexecution-historical-drift'
+preflight = json.loads((BASE / 'runtime-before.json').read_text())
+assert (datetime.datetime.now(datetime.timezone.utc) - datetime.datetime.fromisoformat(preflight['observed_at'])).total_seconds() < 600
+archive = Path(meta['chart_archive'])
+assert hashlib.sha256(archive.read_bytes()).hexdigest() == meta['chart_sha256']
+
+def call(argv, timeout=30):
+    return subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
+
+directory = '/tmp/statehub-binding-guard-b5c0663d830f'
+stage = call(['ssh', 'railiance01', 'set -eu; test ! -e ' + directory + '; umask 077; mkdir ' + directory + '; stat -c "%u %a" ' + directory + '; id -u'])
+assert stage.returncode == 0, 'owned-staging-creation-refused'
+parts = stage.stdout.split()
+assert len(parts) == 3 and parts[0] == parts[2] and parts[1] == '700'
+staging_uid = int(parts[0])
+copy = call(['scp', str(archive), 'railiance01:' + meta['remote_owned_chart']], timeout=45)
+assert copy.returncode == 0, 'reviewed-chart-transfer-refused'
+check = call(['ssh', 'railiance01', 'set -eu; chmod 600 ' + meta['remote_owned_chart'] + '; sha256sum ' + meta['remote_owned_chart'] + '; stat -c "%u %a" ' + meta['remote_owned_chart']])
+assert check.returncode == 0 and check.stdout.split()[0] == meta['chart_sha256']
+assert check.stdout.splitlines()[1] == str(staging_uid) + ' 600'
+(BASE / 'staging.json').write_text(json.dumps({'status':'verified','directory':directory,'uid':staging_uid,'directory_mode':'700','file_mode':'600','archive_sha256':meta['chart_sha256'],'remote_archive':meta['remote_owned_chart']},indent=2)+'\n')
+shutil.copy2(REVIEW / 'watch_rollout.py', BASE / 'watch_rollout.py')
+observer = subprocess.Popen(['python3', str(BASE / 'watch_rollout.py')], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+started = datetime.datetime.now(datetime.timezone.utc).isoformat()
+record = {'proposal_id':meta['proposal_id'],'revision':2,'executed_digest_sha256':PIN,
+          'approval_ref':approval['id'],'started_at':started,'status':'executing',
+          'mode_of_authority':'ADMINISTER @ realm:kubernetes/railiance01','activation':'APPROVED',
+          'exact_argv':meta['exact_upgrade_argv']}
+(BASE / 'execution.json').write_text(json.dumps(record,indent=2)+'\n')
+supervision = ROOT / '.kaizen/agents/custodian-codex/supervision.json'
+data = json.loads(supervision.read_text())
+entry = next(x for x in data['proposals'] if x['proposal_id'] == meta['proposal_id'])
+entry.update(executed_revision=2,executed_digest_sha256=PIN,executed_digest=PIN,
+             execution_started_at=started,execution_ref=str((BASE/'execution.json').relative_to(ROOT)))
+supervision.write_text(json.dumps(data,indent=2)+'\n')
+try:
+    result = call(meta['exact_upgrade_argv'], timeout=240)
+    outcome = {'exit_code':result.returncode,'returned_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),
+               'raw_helm_output_retained':False,'recovery_required':result.returncode != 0}
+except subprocess.TimeoutExpired:
+    outcome = {'exit_code':None,'returned_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),
+               'raw_helm_output_retained':False,'recovery_required':True,'ssh_outcome':'timeout-unverified'}
+(BASE / 'helm-return.json').write_text(json.dumps(outcome,indent=2)+'\n')
+try:
+    observer.wait(timeout=15)
+except subprocess.TimeoutExpired:
+    observer.terminate()
+    observer.wait(timeout=5)
+record['status'] = 'helm-returned-awaiting-acceptance' if outcome['exit_code'] == 0 else 'recovery-assessment-required'
+(BASE / 'execution.json').write_text(json.dumps(record,indent=2)+'\n')
+print(json.dumps(outcome))
+assert outcome['exit_code'] == 0, 'approved-recovery-assessment-required'
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json
new file mode 100644
index 0000000..6c07016
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json
@@ -0,0 +1,18 @@
+{
+  "proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
+  "revision": 2,
+  "executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
+  "approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
+  "started_at": "2026-10-17T01:52:59.649596+00:00",
+  "status": "verified",
+  "mode_of_authority": "ADMINISTER @ realm:kubernetes/railiance01",
+  "activation": "APPROVED",
+  "exact_argv": [
+    "ssh",
+    "railiance01",
+    "KUBECONFIG=/etc/rancher/k3s/k3s.yaml helm -n state-hub upgrade state-hub /tmp/statehub-binding-guard-b5c0663d830f/state-hub-0.1.0.tgz --reuse-values --set-string image.tag=main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1 --atomic --timeout 3m"
+  ],
+  "verified_at": "2026-10-17T01:55:19.742775+00:00",
+  "verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json",
+  "recovery_required": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json
new file mode 100644
index 0000000..cc948da
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json
@@ -0,0 +1,23 @@
+{
+  "schema": "state-hub.release-headroom-preflight.v1",
+  "ok": true,
+  "observed_at": "2026-10-17T01:52:16.534776+00:00",
+  "freshness_seconds": 0,
+  "remaining_cpu_m": 420,
+  "remaining_memory_bytes": 6535979008,
+  "pending_unrelated_cpu_m": 0,
+  "api_surge_cpu_m": 100,
+  "mcp_surge_cpu_m": 10,
+  "migrate_cpu_m": 50,
+  "atomic": true,
+  "reasons": [],
+  "notes": [
+    "Aggregate remaining millicores is not a kube-scheduler guarantee.",
+    "Preflight does not lower requests and does not start Helm."
+  ],
+  "hook_order": [
+    "pre-upgrade migrate job (helm.sh/hook-weight -5)",
+    "API RollingUpdate maxSurge=1 maxUnavailable=0",
+    "MCP RollingUpdate maxSurge=1 maxUnavailable=0"
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json
new file mode 100644
index 0000000..ce1a1f9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json
@@ -0,0 +1,136 @@
+{
+  "schema": "statehub.exact-reuse-values-readonly-diff.v1",
+  "status": "passed_images_only",
+  "dryrun_argv": [
+    "helm",
+    "--kubeconfig",
+    "/home/worsch/.kube/config-railiance01",
+    "-n",
+    "state-hub",
+    "upgrade",
+    "state-hub",
+    "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/state-hub-0.1.0.tgz",
+    "--reuse-values",
+    "--set-string",
+    "image.tag=main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
+    "--dry-run=server",
+    "--hide-secret",
+    "--no-hooks",
+    "--timeout",
+    "3m"
+  ],
+  "production_mutations": false,
+  "hooks_executed": false,
+  "raw_helm_values_release_content_logs_retained": false,
+  "limitations": [
+    "Dry-run admission/render only, not an actual image pull/migration/deployment.",
+    "Helm timeout does not stop a later live migration Job; exact scoped cancellation/quiescence remains required."
+  ],
+  "chart_archive_sha256": "sha256:b5c0663d830fc8d3b65080f237a0be8d01f8b2f7fec9dc33aeba91b1b6b281d4",
+  "stage": "exact_upgrade_server_dryrun",
+  "objects": [
+    {
+      "api_version": "apps/v1",
+      "kind": "Deployment",
+      "namespace": "state-hub",
+      "name": "state-hub",
+      "intended_images": [
+        "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
+      ],
+      "intended_spec_sha256": "sha256:df32d106c28b270c67aa683c8a4f20b26c430b121420c4023d34d23ede0eaed9",
+      "baseline_object_sha256": "sha256:01e7278447f3204ec8abfd9a7b5b6be61850995b3e792fc1f97fbc3207536d69",
+      "intended_object_sha256": "sha256:7b7c78921b071732c8e7c4c062bdbd26787498581102ea9916b07c1f57887a73",
+      "changed_paths": [
+        "/spec/template/spec/containers/0/image"
+      ]
+    },
+    {
+      "api_version": "apps/v1",
+      "kind": "Deployment",
+      "namespace": "state-hub",
+      "name": "state-hub-mcp",
+      "intended_images": [
+        "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
+      ],
+      "intended_spec_sha256": "sha256:50ae88c8c57919bf745a772a8ff34ea7e469751a403ac39d1d01ab2e9d3a27db",
+      "baseline_object_sha256": "sha256:9a4376e004060a4ec2c76784fd50ec6ce05f61b3793f6458625d88122a7b8713",
+      "intended_object_sha256": "sha256:b78c66a3e27bca60ff4dd4f51c1bbe789a4e246be3d1e7e6fb9659ffdce80127",
+      "changed_paths": [
+        "/spec/template/spec/containers/0/image"
+      ]
+    },
+    {
+      "api_version": "batch/v1",
+      "kind": "Job",
+      "namespace": "state-hub",
+      "name": "state-hub-migrate",
+      "intended_images": [
+        "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
+      ],
+      "intended_spec_sha256": "sha256:2eb273b5e2ca5538fa1b13a8cf8cd10d259ad7cd3510bce1e86075f8c4c4a915",
+      "baseline_object_sha256": "sha256:6909dca9acd5e1b816491b91b6a32ef6d934e288e2d8d0d3d66fac9fe67468ec",
+      "intended_object_sha256": "sha256:208b52d9b958b9d4490182bda4d0da27b4a6f0961f6bf182c34ef4b640fcbb5e",
+      "changed_paths": [
+        "/spec/template/spec/containers/0/image"
+      ]
+    },
+    {
+      "api_version": "v1",
+      "kind": "ConfigMap",
+      "namespace": "state-hub",
+      "name": "state-hub-classification-allowed",
+      "intended_images": [],
+      "intended_spec_sha256": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+      "baseline_object_sha256": "sha256:924d16a0a6b4ba8a46b59f0990dcc2adc6dd813cf5d7d83bdb389844068d7cfd",
+      "intended_object_sha256": "sha256:924d16a0a6b4ba8a46b59f0990dcc2adc6dd813cf5d7d83bdb389844068d7cfd",
+      "changed_paths": []
+    },
+    {
+      "api_version": "v1",
+      "kind": "ConfigMap",
+      "namespace": "state-hub",
+      "name": "state-hub-config",
+      "intended_images": [],
+      "intended_spec_sha256": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+      "baseline_object_sha256": "sha256:26707b20933b4f6de78f9059c0efec6df7f0e90c8f1a67db6d2f1ac72e674560",
+      "intended_object_sha256": "sha256:26707b20933b4f6de78f9059c0efec6df7f0e90c8f1a67db6d2f1ac72e674560",
+      "changed_paths": []
+    },
+    {
+      "api_version": "v1",
+      "kind": "Service",
+      "namespace": "state-hub",
+      "name": "state-hub",
+      "intended_images": [],
+      "intended_spec_sha256": "sha256:da5895e6aee1f619d16c07dafd4342cf7ec8f9de0944a84979c624a4e9eea22a",
+      "baseline_object_sha256": "sha256:62098bbc3ef6265e072f416ecb11de85d59fce7e2e0d22b2616bd233e720dafe",
+      "intended_object_sha256": "sha256:62098bbc3ef6265e072f416ecb11de85d59fce7e2e0d22b2616bd233e720dafe",
+      "changed_paths": []
+    },
+    {
+      "api_version": "v1",
+      "kind": "Service",
+      "namespace": "state-hub",
+      "name": "state-hub-mcp",
+      "intended_images": [],
+      "intended_spec_sha256": "sha256:4e04175b03bcd75833109d6843e282cee79d73eae2bc85e36097264b832ba26f",
+      "baseline_object_sha256": "sha256:ab096d239c9cd72e6177a260d9b4d548a7d5b7c0a285c3a11b7267193e336bba",
+      "intended_object_sha256": "sha256:ab096d239c9cd72e6177a260d9b4d548a7d5b7c0a285c3a11b7267193e336bba",
+      "changed_paths": []
+    },
+    {
+      "api_version": "v1",
+      "kind": "ServiceAccount",
+      "namespace": "state-hub",
+      "name": "state-hub",
+      "intended_images": [],
+      "intended_spec_sha256": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+      "baseline_object_sha256": "sha256:750594b51a534d603f50640d02a3c4eec79cc52fe07d5f442102d37b7299adb8",
+      "intended_object_sha256": "sha256:750594b51a534d603f50640d02a3c4eec79cc52fe07d5f442102d37b7299adb8",
+      "changed_paths": []
+    }
+  ],
+  "changed_object_count": 3,
+  "intended_diff_only_images": true,
+  "object_identity_set_unchanged": true
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json
new file mode 100644
index 0000000..acffd93
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json
@@ -0,0 +1,20 @@
+{
+  "status": "verified",
+  "archives": [
+    {
+      "path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md",
+      "sha256": "8d6f8533c119117686bc0d5bb9ed5349726aa6c3189ff98b53409c68ac685ca9",
+      "unchanged": true
+    },
+    {
+      "path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
+      "sha256": "4dc2f61e15adc3c5c81f9ecf8b933512275b95e8f829fac52ae7cde1385cea4a",
+      "unchanged": true
+    },
+    {
+      "path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md",
+      "sha256": "04f787078232395bd2d43861de16c521848559fa286f06e1caa9cb779aa71ac3",
+      "unchanged": true
+    }
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json
new file mode 100644
index 0000000..82c6389
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json
@@ -0,0 +1,147 @@
+{
+  "credential_values_exposed": false,
+  "historical_module_sha256": "sha256:e24e57c58f4aaa4ec9d9bf088009ac69006e53f75b9477ee53dc26c4e850b975",
+  "raw_rows_retained": false,
+  "schema": "state95.full-db-row-hash-snapshot.v1",
+  "status": "captured_readonly",
+  "tables": {
+    "tasks": {
+      "all_rows_sha256": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
+      "columns": [
+        "assignee",
+        "blocked_on",
+        "blocking_reason",
+        "created_at",
+        "decision_id",
+        "description",
+        "due_date",
+        "flavor",
+        "id",
+        "intervention_note",
+        "needs_human",
+        "parent_task_id",
+        "priority",
+        "record_id",
+        "status",
+        "title",
+        "updated_at",
+        "wait_until",
+        "workplan_id"
+      ],
+      "row_count": 15,
+      "rows": [
+        {
+          "sha256": "sha256:89b3be69fbaf5ad60f5aefa6f2b630e1d6124e0fca7b01a5e9ce1ff41a451106",
+          "uuid": "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
+        },
+        {
+          "sha256": "sha256:3aa20e9695e110468d13baa3c813ac5b474896d89eeb6edc56e9ea00d9199fd7",
+          "uuid": "08233868-d522-4117-bc4e-6c0f52545665"
+        },
+        {
+          "sha256": "sha256:72fb54d9a271067a62f33377d56e0bb9e6874a3f9c475b9ae049609b93d1f643",
+          "uuid": "140da396-8e30-4f4d-b88c-c42c0cd46c01"
+        },
+        {
+          "sha256": "sha256:15198017e5c7d31b4e8ce1d5c0ef0de99ac1c50d3bffd0ea0ee807bef70ce5d1",
+          "uuid": "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
+        },
+        {
+          "sha256": "sha256:29a6f1e50db6a7b4ba5b98a2f7d8d109b4df1720fce58777c21f7538084f8cda",
+          "uuid": "3f042630-eab0-4c6a-9167-e2b28ff20e40"
+        },
+        {
+          "sha256": "sha256:2e00141f0d7382dd34859b686a500dc740a543efe81e23f5805754cbc6761f2e",
+          "uuid": "4526a842-ea31-4874-9231-92ab556cfe7b"
+        },
+        {
+          "sha256": "sha256:7b3ecacb7be3c1a24a100d7b732b7f60e1a99329a6847612264cd01d13c7ecf0",
+          "uuid": "5c3d40e4-239b-488e-9519-6f7a38d2325f"
+        },
+        {
+          "sha256": "sha256:71107455d1d453d69d65466ca66da1fd4ee4aa95ecdf7920b9acdce767f0c55c",
+          "uuid": "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
+        },
+        {
+          "sha256": "sha256:f8e44ea79125870ab3ade44afab8752c126c424e2b751f48b9fe555e00b5b708",
+          "uuid": "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
+        },
+        {
+          "sha256": "sha256:435e39ffee3a59eae3b890739a6ed8e06801fb23dead15073653d8650f9d5ff5",
+          "uuid": "a6313e06-1976-46a7-8e31-df4eb2eca880"
+        },
+        {
+          "sha256": "sha256:2fcda8440a166fc628f8fadf91a4a23ba7728ccac2e629248c6eccd00d5d4345",
+          "uuid": "ab166073-30a7-4702-a037-4091e8706e20"
+        },
+        {
+          "sha256": "sha256:b2e11b8fdc580e6cb7ec20c7e90018ba9fb468893b6eda5b9519dc68737a0ca0",
+          "uuid": "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
+        },
+        {
+          "sha256": "sha256:788862d9cc5015b927d27303585431a0db4af6077178ab3bfdde37f900cee821",
+          "uuid": "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
+        },
+        {
+          "sha256": "sha256:f7bc1f3acf187301430df0623417fb90b6af1869c0383a0bff9ec25f79ffe4af",
+          "uuid": "e8510646-46ed-4697-a345-f3d3009eea78"
+        },
+        {
+          "sha256": "sha256:f2760deded2f7136a60fba0156c4956ba373fbcf5eda986f5c380d7ee9c925ff",
+          "uuid": "f8e4a094-c367-40eb-b895-da17bc144b07"
+        }
+      ]
+    },
+    "workplans": {
+      "all_rows_sha256": "sha256:1cd4e695c8f8da8bdb2335a8770a219f704f3989f14d28ebf0b1494f2458dc4a",
+      "columns": [
+        "backing_archived",
+        "backing_filename",
+        "backing_relative_path",
+        "backing_synced_at",
+        "concurrency_mode",
+        "created_at",
+        "derived_from_commit",
+        "description",
+        "due_date",
+        "execution_group",
+        "execution_state",
+        "flavor",
+        "flavor_promoted_from",
+        "flavor_promotion_reason",
+        "id",
+        "launch_mode",
+        "owner",
+        "planning_order",
+        "planning_priority",
+        "projection_retired_at",
+        "projection_retired_reason",
+        "queue_rank",
+        "repo_goal_id",
+        "repo_id",
+        "scheduled_for",
+        "slug",
+        "status",
+        "title",
+        "topic_id",
+        "updated_at"
+      ],
+      "row_count": 3,
+      "rows": [
+        {
+          "sha256": "sha256:bfd3b3abe48d989b1c253d8cca57c463c40e63413885f467b3f3e2187d33cb49",
+          "uuid": "4c63dfc6-9eac-4e79-9f77-8f644ad7147d"
+        },
+        {
+          "sha256": "sha256:c3f19622843b62cea0fd987ed550fe8d050214a952f77f9250e1696506130303",
+          "uuid": "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
+        },
+        {
+          "sha256": "sha256:a406d311c2c0421eb7646edf4d215dbd96f570d07b2ba0bc6a747d7c573f0b9a",
+          "uuid": "7ee9ee22-1fae-4567-9194-8d70a9e0f45b"
+        }
+      ]
+    }
+  },
+  "current_baseline_equal": true
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json
new file mode 100644
index 0000000..ca84f85
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json
@@ -0,0 +1,146 @@
+{
+  "credential_values_exposed": false,
+  "historical_module_sha256": "sha256:e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2",
+  "raw_rows_retained": false,
+  "schema": "state95.full-db-row-hash-snapshot.v1",
+  "status": "captured_readonly",
+  "tables": {
+    "tasks": {
+      "all_rows_sha256": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
+      "columns": [
+        "assignee",
+        "blocked_on",
+        "blocking_reason",
+        "created_at",
+        "decision_id",
+        "description",
+        "due_date",
+        "flavor",
+        "id",
+        "intervention_note",
+        "needs_human",
+        "parent_task_id",
+        "priority",
+        "record_id",
+        "status",
+        "title",
+        "updated_at",
+        "wait_until",
+        "workplan_id"
+      ],
+      "row_count": 15,
+      "rows": [
+        {
+          "sha256": "sha256:89b3be69fbaf5ad60f5aefa6f2b630e1d6124e0fca7b01a5e9ce1ff41a451106",
+          "uuid": "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
+        },
+        {
+          "sha256": "sha256:3aa20e9695e110468d13baa3c813ac5b474896d89eeb6edc56e9ea00d9199fd7",
+          "uuid": "08233868-d522-4117-bc4e-6c0f52545665"
+        },
+        {
+          "sha256": "sha256:72fb54d9a271067a62f33377d56e0bb9e6874a3f9c475b9ae049609b93d1f643",
+          "uuid": "140da396-8e30-4f4d-b88c-c42c0cd46c01"
+        },
+        {
+          "sha256": "sha256:15198017e5c7d31b4e8ce1d5c0ef0de99ac1c50d3bffd0ea0ee807bef70ce5d1",
+          "uuid": "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
+        },
+        {
+          "sha256": "sha256:29a6f1e50db6a7b4ba5b98a2f7d8d109b4df1720fce58777c21f7538084f8cda",
+          "uuid": "3f042630-eab0-4c6a-9167-e2b28ff20e40"
+        },
+        {
+          "sha256": "sha256:2e00141f0d7382dd34859b686a500dc740a543efe81e23f5805754cbc6761f2e",
+          "uuid": "4526a842-ea31-4874-9231-92ab556cfe7b"
+        },
+        {
+          "sha256": "sha256:7b3ecacb7be3c1a24a100d7b732b7f60e1a99329a6847612264cd01d13c7ecf0",
+          "uuid": "5c3d40e4-239b-488e-9519-6f7a38d2325f"
+        },
+        {
+          "sha256": "sha256:71107455d1d453d69d65466ca66da1fd4ee4aa95ecdf7920b9acdce767f0c55c",
+          "uuid": "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
+        },
+        {
+          "sha256": "sha256:f8e44ea79125870ab3ade44afab8752c126c424e2b751f48b9fe555e00b5b708",
+          "uuid": "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
+        },
+        {
+          "sha256": "sha256:435e39ffee3a59eae3b890739a6ed8e06801fb23dead15073653d8650f9d5ff5",
+          "uuid": "a6313e06-1976-46a7-8e31-df4eb2eca880"
+        },
+        {
+          "sha256": "sha256:2fcda8440a166fc628f8fadf91a4a23ba7728ccac2e629248c6eccd00d5d4345",
+          "uuid": "ab166073-30a7-4702-a037-4091e8706e20"
+        },
+        {
+          "sha256": "sha256:b2e11b8fdc580e6cb7ec20c7e90018ba9fb468893b6eda5b9519dc68737a0ca0",
+          "uuid": "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
+        },
+        {
+          "sha256": "sha256:788862d9cc5015b927d27303585431a0db4af6077178ab3bfdde37f900cee821",
+          "uuid": "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
+        },
+        {
+          "sha256": "sha256:f7bc1f3acf187301430df0623417fb90b6af1869c0383a0bff9ec25f79ffe4af",
+          "uuid": "e8510646-46ed-4697-a345-f3d3009eea78"
+        },
+        {
+          "sha256": "sha256:f2760deded2f7136a60fba0156c4956ba373fbcf5eda986f5c380d7ee9c925ff",
+          "uuid": "f8e4a094-c367-40eb-b895-da17bc144b07"
+        }
+      ]
+    },
+    "workplans": {
+      "all_rows_sha256": "sha256:1cd4e695c8f8da8bdb2335a8770a219f704f3989f14d28ebf0b1494f2458dc4a",
+      "columns": [
+        "backing_archived",
+        "backing_filename",
+        "backing_relative_path",
+        "backing_synced_at",
+        "concurrency_mode",
+        "created_at",
+        "derived_from_commit",
+        "description",
+        "due_date",
+        "execution_group",
+        "execution_state",
+        "flavor",
+        "flavor_promoted_from",
+        "flavor_promotion_reason",
+        "id",
+        "launch_mode",
+        "owner",
+        "planning_order",
+        "planning_priority",
+        "projection_retired_at",
+        "projection_retired_reason",
+        "queue_rank",
+        "repo_goal_id",
+        "repo_id",
+        "scheduled_for",
+        "slug",
+        "status",
+        "title",
+        "topic_id",
+        "updated_at"
+      ],
+      "row_count": 3,
+      "rows": [
+        {
+          "sha256": "sha256:bfd3b3abe48d989b1c253d8cca57c463c40e63413885f467b3f3e2187d33cb49",
+          "uuid": "4c63dfc6-9eac-4e79-9f77-8f644ad7147d"
+        },
+        {
+          "sha256": "sha256:c3f19622843b62cea0fd987ed550fe8d050214a952f77f9250e1696506130303",
+          "uuid": "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
+        },
+        {
+          "sha256": "sha256:a406d311c2c0421eb7646edf4d215dbd96f570d07b2ba0bc6a747d7c573f0b9a",
+          "uuid": "7ee9ee22-1fae-4567-9194-8d70a9e0f45b"
+        }
+      ]
+    }
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json
new file mode 100644
index 0000000..82c6389
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json
@@ -0,0 +1,147 @@
+{
+  "credential_values_exposed": false,
+  "historical_module_sha256": "sha256:e24e57c58f4aaa4ec9d9bf088009ac69006e53f75b9477ee53dc26c4e850b975",
+  "raw_rows_retained": false,
+  "schema": "state95.full-db-row-hash-snapshot.v1",
+  "status": "captured_readonly",
+  "tables": {
+    "tasks": {
+      "all_rows_sha256": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
+      "columns": [
+        "assignee",
+        "blocked_on",
+        "blocking_reason",
+        "created_at",
+        "decision_id",
+        "description",
+        "due_date",
+        "flavor",
+        "id",
+        "intervention_note",
+        "needs_human",
+        "parent_task_id",
+        "priority",
+        "record_id",
+        "status",
+        "title",
+        "updated_at",
+        "wait_until",
+        "workplan_id"
+      ],
+      "row_count": 15,
+      "rows": [
+        {
+          "sha256": "sha256:89b3be69fbaf5ad60f5aefa6f2b630e1d6124e0fca7b01a5e9ce1ff41a451106",
+          "uuid": "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
+        },
+        {
+          "sha256": "sha256:3aa20e9695e110468d13baa3c813ac5b474896d89eeb6edc56e9ea00d9199fd7",
+          "uuid": "08233868-d522-4117-bc4e-6c0f52545665"
+        },
+        {
+          "sha256": "sha256:72fb54d9a271067a62f33377d56e0bb9e6874a3f9c475b9ae049609b93d1f643",
+          "uuid": "140da396-8e30-4f4d-b88c-c42c0cd46c01"
+        },
+        {
+          "sha256": "sha256:15198017e5c7d31b4e8ce1d5c0ef0de99ac1c50d3bffd0ea0ee807bef70ce5d1",
+          "uuid": "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
+        },
+        {
+          "sha256": "sha256:29a6f1e50db6a7b4ba5b98a2f7d8d109b4df1720fce58777c21f7538084f8cda",
+          "uuid": "3f042630-eab0-4c6a-9167-e2b28ff20e40"
+        },
+        {
+          "sha256": "sha256:2e00141f0d7382dd34859b686a500dc740a543efe81e23f5805754cbc6761f2e",
+          "uuid": "4526a842-ea31-4874-9231-92ab556cfe7b"
+        },
+        {
+          "sha256": "sha256:7b3ecacb7be3c1a24a100d7b732b7f60e1a99329a6847612264cd01d13c7ecf0",
+          "uuid": "5c3d40e4-239b-488e-9519-6f7a38d2325f"
+        },
+        {
+          "sha256": "sha256:71107455d1d453d69d65466ca66da1fd4ee4aa95ecdf7920b9acdce767f0c55c",
+          "uuid": "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
+        },
+        {
+          "sha256": "sha256:f8e44ea79125870ab3ade44afab8752c126c424e2b751f48b9fe555e00b5b708",
+          "uuid": "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
+        },
+        {
+          "sha256": "sha256:435e39ffee3a59eae3b890739a6ed8e06801fb23dead15073653d8650f9d5ff5",
+          "uuid": "a6313e06-1976-46a7-8e31-df4eb2eca880"
+        },
+        {
+          "sha256": "sha256:2fcda8440a166fc628f8fadf91a4a23ba7728ccac2e629248c6eccd00d5d4345",
+          "uuid": "ab166073-30a7-4702-a037-4091e8706e20"
+        },
+        {
+          "sha256": "sha256:b2e11b8fdc580e6cb7ec20c7e90018ba9fb468893b6eda5b9519dc68737a0ca0",
+          "uuid": "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
+        },
+        {
+          "sha256": "sha256:788862d9cc5015b927d27303585431a0db4af6077178ab3bfdde37f900cee821",
+          "uuid": "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
+        },
+        {
+          "sha256": "sha256:f7bc1f3acf187301430df0623417fb90b6af1869c0383a0bff9ec25f79ffe4af",
+          "uuid": "e8510646-46ed-4697-a345-f3d3009eea78"
+        },
+        {
+          "sha256": "sha256:f2760deded2f7136a60fba0156c4956ba373fbcf5eda986f5c380d7ee9c925ff",
+          "uuid": "f8e4a094-c367-40eb-b895-da17bc144b07"
+        }
+      ]
+    },
+    "workplans": {
+      "all_rows_sha256": "sha256:1cd4e695c8f8da8bdb2335a8770a219f704f3989f14d28ebf0b1494f2458dc4a",
+      "columns": [
+        "backing_archived",
+        "backing_filename",
+        "backing_relative_path",
+        "backing_synced_at",
+        "concurrency_mode",
+        "created_at",
+        "derived_from_commit",
+        "description",
+        "due_date",
+        "execution_group",
+        "execution_state",
+        "flavor",
+        "flavor_promoted_from",
+        "flavor_promotion_reason",
+        "id",
+        "launch_mode",
+        "owner",
+        "planning_order",
+        "planning_priority",
+        "projection_retired_at",
+        "projection_retired_reason",
+        "queue_rank",
+        "repo_goal_id",
+        "repo_id",
+        "scheduled_for",
+        "slug",
+        "status",
+        "title",
+        "topic_id",
+        "updated_at"
+      ],
+      "row_count": 3,
+      "rows": [
+        {
+          "sha256": "sha256:bfd3b3abe48d989b1c253d8cca57c463c40e63413885f467b3f3e2187d33cb49",
+          "uuid": "4c63dfc6-9eac-4e79-9f77-8f644ad7147d"
+        },
+        {
+          "sha256": "sha256:c3f19622843b62cea0fd987ed550fe8d050214a952f77f9250e1696506130303",
+          "uuid": "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
+        },
+        {
+          "sha256": "sha256:a406d311c2c0421eb7646edf4d215dbd96f570d07b2ba0bc6a747d7c573f0b9a",
+          "uuid": "7ee9ee22-1fae-4567-9194-8d70a9e0f45b"
+        }
+      ]
+    }
+  },
+  "current_baseline_equal": true
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json
new file mode 100644
index 0000000..deee20c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json
@@ -0,0 +1,6 @@
+{
+  "exit_code": 0,
+  "returned_at": "2026-10-17T01:53:28.489168+00:00",
+  "raw_helm_output_retained": false,
+  "recovery_required": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json
new file mode 100644
index 0000000..1e28889
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json
@@ -0,0 +1,34 @@
+{
+  "schema": "state95.approved-job-observation.v1",
+  "mutation": false,
+  "started_at": "2026-10-17T01:52:59.690085+00:00",
+  "jobs": {
+    "99ebab16-f0e7-49ac-8db3-b3b34f7331df": {
+      "uid": "99ebab16-f0e7-49ac-8db3-b3b34f7331df",
+      "name": "state-hub-migrate",
+      "created_at": "2026-10-17T01:53:02Z",
+      "image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
+      "managed_by": "Helm",
+      "release": "state-hub",
+      "hook": "pre-install,pre-upgrade",
+      "pods": {
+        "38fa8c07-e688-4838-a079-42fe15e5309a": {
+          "name": "state-hub-migrate-vq7jf",
+          "uid": "38fa8c07-e688-4838-a079-42fe15e5309a",
+          "owner_job_uid": "99ebab16-f0e7-49ac-8db3-b3b34f7331df",
+          "pod_ip": "10.42.0.58",
+          "phase": "Succeeded"
+        }
+      },
+      "last_status": {
+        "active": 1,
+        "succeeded": null,
+        "failed": null
+      }
+    }
+  },
+  "poll_failures": 0,
+  "job_absent_after_observation": true,
+  "helm_return_observed": true,
+  "ended_at": "2026-10-17T01:53:28.735886+00:00"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json
new file mode 100644
index 0000000..60b8183
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json
@@ -0,0 +1,81 @@
+{
+  "after_full_row_hashes": {
+    "tasks": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
+    "workplans": "sha256:2636d0a3e0ac6a3fe4e599b47f67b0b5dde6abfcb8da1ab5df446fe5ebe69d85"
+  },
+  "before_full_row_hashes": {
+    "tasks": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
+    "workplans": "sha256:2636d0a3e0ac6a3fe4e599b47f67b0b5dde6abfcb8da1ab5df446fe5ebe69d85"
+  },
+  "cases": {
+    "foreign-holder-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "foreign-repo-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "invalid-last-binding-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "invalid-path-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "missing-task-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "nonterminal-parent-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "nonterminal-task-mixed": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "refused",
+      "rolled_back": true,
+      "status": "passed"
+    },
+    "preserve-three": {
+      "commit_attempts": 0,
+      "full_rows_restored": true,
+      "outcome": "preserved",
+      "rolled_back": true,
+      "status": "passed"
+    }
+  },
+  "commit_interception_enforced": true,
+  "commits_performed": 0,
+  "fresh_transaction_full_rows_equal": true,
+  "historical_parents": 3,
+  "historical_tasks": 15,
+  "limits": [
+    "No claim of restoring pre-legacy-refresh parent preimages.",
+    "Missing actual parent/repo rows and full concurrent-writer behavior remain source-test coverage, not claimed as these native cases."
+  ],
+  "ordinary_parent_also_preserved": true,
+  "raw_rows_or_credentials_retained": false,
+  "schema": "state95.native-guard-probes.v1",
+  "status": "passed"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-bindings.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-bindings.json
new file mode 100644
index 0000000..5c251bc
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-bindings.json
@@ -0,0 +1,304 @@
+{
+  "schema": "custodian.rollout-owner-bindings.v1",
+  "status": "verified",
+  "primary": "primary/railiance01",
+  "task_bindings": 26,
+  "rows": [
+    {
+      "repo": "state-hub",
+      "workplan_id": "STATE-WP-0095",
+      "commit": "200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a",
+      "remote_exact": true,
+      "source_sha256": "31bea1d5b54f9f6e5bc01d11d271c3a86ac76389350b467ba568b9dc93e41c61",
+      "status": "finished",
+      "tasks": [
+        {
+          "id": "2dd9b04f-2250-5a8a-b5bc-c8a009872858",
+          "record_id": "STATE-WP-0095-T08",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "339b9a37-181c-5599-9a89-0393e199bd4b",
+          "record_id": "STATE-WP-0095-T05",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "3bbb311f-194e-5862-8aed-358a580f22b4",
+          "record_id": "STATE-WP-0095-T04",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "6a5f87bb-e63d-5e20-b9fc-c1b5cd403ff7",
+          "record_id": "STATE-WP-0095-T01",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
+          "record_id": "STATE-WP-0095-T06",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
+          "record_id": "STATE-WP-0095-T10",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "8be8f13b-6352-5295-9755-de6fbfb13593",
+          "record_id": "STATE-WP-0095-T09",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
+          "record_id": "STATE-WP-0095-T07",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
+          "record_id": "STATE-WP-0095-T03",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "ebb24194-e4cc-5130-aaa6-663f2ea2c822",
+          "record_id": "STATE-WP-0095-T02",
+          "status": "done",
+          "needs_human": false
+        }
+      ],
+      "projected_edges": [],
+      "unprojected_source_declarations": [
+        {
+          "from_task_id": "3bbb311f-194e-5862-8aed-358a580f22b4",
+          "to_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "3bbb311f-194e-5862-8aed-358a580f22b4",
+          "to_task_id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
+          "to_task_id": "339b9a37-181c-5599-9a89-0393e199bd4b",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
+          "to_task_id": "8be8f13b-6352-5295-9755-de6fbfb13593",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "8be8f13b-6352-5295-9755-de6fbfb13593",
+          "to_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
+          "to_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
+          "to_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
+          "to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
+          "to_task_id": "ebb24194-e4cc-5130-aaa6-663f2ea2c822",
+          "relationship_type": "starts_after"
+        }
+      ]
+    },
+    {
+      "repo": "repo-manager",
+      "workplan_id": "RMGR-WP-0019",
+      "commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
+      "remote_exact": true,
+      "source_sha256": "189372458e1b072451eb64333e38f849835c16dba5bb69deed2a17794644986d",
+      "status": "finished",
+      "tasks": [
+        {
+          "id": "1ccb06c6-ad30-5847-8704-e5628ba81f35",
+          "record_id": "RMGR-WP-0019-T04",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
+          "record_id": "RMGR-WP-0019-T05",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
+          "record_id": "RMGR-WP-0019-T06",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
+          "record_id": "RMGR-WP-0019-T03",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "95240c81-1805-5365-9b35-d238621a16bf",
+          "record_id": "RMGR-WP-0019-T02",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "d78a622e-39f9-5923-b4e1-f70fdc17fb42",
+          "record_id": "RMGR-WP-0019-T01",
+          "status": "done",
+          "needs_human": false
+        }
+      ],
+      "projected_edges": [
+        {
+          "from_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
+          "to_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
+          "relationship_type": "starts_after"
+        }
+      ],
+      "unprojected_source_declarations": [
+        {
+          "from_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
+          "to_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
+          "to_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
+          "to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
+          "to_task_id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
+          "relationship_type": "starts_after"
+        }
+      ]
+    },
+    {
+      "repo": "repo-manager",
+      "workplan_id": "RMGR-WP-0021",
+      "commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
+      "remote_exact": true,
+      "source_sha256": "966d15ccdabc8edf98bc58f9422ea190566d05fe4208f4749f59a9731f4e108d",
+      "status": "active",
+      "tasks": [
+        {
+          "id": "0ab44bd9-00d8-5470-ad45-7350e7868d0a",
+          "record_id": "RMGR-WP-0021-T03",
+          "status": "progress",
+          "needs_human": false
+        },
+        {
+          "id": "25fbe694-41d8-5232-bce0-4ed362387d5a",
+          "record_id": "RMGR-WP-0021-T05",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "44272818-db49-58a2-83b1-d2f9e9d5976c",
+          "record_id": "RMGR-WP-0021-T04",
+          "status": "todo",
+          "needs_human": false
+        },
+        {
+          "id": "d3d20c18-5a5f-5f8a-b5c4-a22b4b662ebe",
+          "record_id": "RMGR-WP-0021-T01",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "e27817e6-b298-581f-b99a-05ec459be749",
+          "record_id": "RMGR-WP-0021-T02",
+          "status": "done",
+          "needs_human": false
+        }
+      ],
+      "projected_edges": [],
+      "unprojected_source_declarations": []
+    },
+    {
+      "repo": "railiance-cluster",
+      "workplan_id": "RCLUSTER-WP-0018",
+      "commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
+      "remote_exact": true,
+      "source_sha256": "96d52b6dbae056399159632d50b32ccc6662e4f6d3677af154f7c8a3d618334b",
+      "status": "active",
+      "tasks": [
+        {
+          "id": "021b07bb-65bc-5743-bac5-4294b4be74f6",
+          "record_id": "RCLUSTER-WP-0018-T04",
+          "status": "wait",
+          "needs_human": true
+        },
+        {
+          "id": "5bc67a22-0991-5625-86a6-f749560d8a0e",
+          "record_id": "RCLUSTER-WP-0018-T05",
+          "status": "todo",
+          "needs_human": false
+        },
+        {
+          "id": "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a",
+          "record_id": "RCLUSTER-WP-0018-T03",
+          "status": "wait",
+          "needs_human": false
+        },
+        {
+          "id": "7280193d-0d59-5b78-a2d3-96ebd127127f",
+          "record_id": "RCLUSTER-WP-0018-T01",
+          "status": "done",
+          "needs_human": false
+        },
+        {
+          "id": "90836435-917f-504c-a711-3f29ece348e3",
+          "record_id": "RCLUSTER-WP-0018-T02",
+          "status": "todo",
+          "needs_human": false
+        }
+      ],
+      "projected_edges": [
+        {
+          "from_task_id": "021b07bb-65bc-5743-bac5-4294b4be74f6",
+          "to_task_id": "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "021b07bb-65bc-5743-bac5-4294b4be74f6",
+          "to_task_id": "90836435-917f-504c-a711-3f29ece348e3",
+          "relationship_type": "starts_after"
+        },
+        {
+          "from_task_id": "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a",
+          "to_task_id": "90836435-917f-504c-a711-3f29ece348e3",
+          "relationship_type": "starts_after"
+        }
+      ],
+      "unprojected_source_declarations": []
+    }
+  ],
+  "runtime_deployed_source": "c103cbf3c8bed5dba87a03e320595ddded9301a3",
+  "helm_revision": 77,
+  "native_target_gates_closed": 0
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-heads.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-heads.json
new file mode 100644
index 0000000..c3b1b5c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-heads.json
@@ -0,0 +1,26 @@
+[
+  [
+    "state-hub",
+    "STATE-WP-0095",
+    "200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a",
+    10
+  ],
+  [
+    "repo-manager",
+    "RMGR-WP-0019",
+    "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
+    6
+  ],
+  [
+    "repo-manager",
+    "RMGR-WP-0021",
+    "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
+    5
+  ],
+  [
+    "railiance-cluster",
+    "RCLUSTER-WP-0018",
+    "6ae3f847c83da3402883453ee7110457bfb2d0d6",
+    5
+  ]
+]
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publication-inputs.json
new file mode 100644
index 0000000..8c5082f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publication-inputs.json
@@ -0,0 +1,168 @@
+{
+  "schema": "custodian.scoped-runtime-checkpoint.v1",
+  "base_commit": "b17e753efc8022fd482e3b2169ba3a604e4bb526",
+  "approved_executed_proposal_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
+  "runtime_return_sha256": "09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a",
+  "files": [
+    {
+      "path": ".kaizen/agents/custodian-codex/supervision.json",
+      "sha256": "4a4b0e61df23f1499916c04d85e61c558df810f43f485abf84792acfbbb66016",
+      "bytes": 80030
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json",
+      "sha256": "f7b12514c52f815854c5bcda8b41fdfef34ee8488c8d4ec779cfc41ae6493d7e",
+      "bytes": 2249
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/check_live.py",
+      "sha256": "f099a44ae5781d9c626c3875db4032bf1d8f2f058be859130a21fe9d0536ea32",
+      "bytes": 6292
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/coordination-receipt.json",
+      "sha256": "16228c4a915bb23e0ab16c2cf7a5f9db1a5fa54785d1baa39a9b8b9b771d94ca",
+      "bytes": 1821
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execute.py",
+      "sha256": "9f9a43f6d6441bc15782ebb9f912590a729af023bee4c60598241f8fad03757a",
+      "bytes": 4750
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json",
+      "sha256": "b772cb147a2ee18eecfa39fc8eda0fe92b6cec35a1f302bbe3da024ae6e06d5c",
+      "bytes": 957
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json",
+      "sha256": "a296873b93c18a31068f1c41c3600d681c2829c00fb6fb458ce6faa5f3718c27",
+      "bytes": 698
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json",
+      "sha256": "2bfb02130876aeb71a773585dae8b446ad5c671050ebc14d0fc7bcce86dffea5",
+      "bytes": 5916
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json",
+      "sha256": "95995c0184c707238d531d5113ae3798ef66051a507bf5a0b70af2966900b217",
+      "bytes": 643
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json",
+      "sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf",
+      "bytes": 4973
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json",
+      "sha256": "bd6f1629bc44858dd914ae33c94e72ef4cbd1893c1ff164c5bbf27db02d1d3b8",
+      "bytes": 4939
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json",
+      "sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf",
+      "bytes": 4973
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json",
+      "sha256": "af4d48460996dadb460f9a01a33fc6b06dfcd762b36a34dbac078a758ea94ac6",
+      "bytes": 141
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json",
+      "sha256": "dc2d959cdcc342395fc53a2e316f6d95b650d6526343a7b07eb8fdc90570c12a",
+      "bytes": 1136
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json",
+      "sha256": "682cc03c42af5b9be1046390b2f50b83b3e5cad6fb2f89d51740a768706e8489",
+      "bytes": 2423
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-bindings.json",
+      "sha256": "aa545a86b66a8c455ecd553af0293306b05e69c8be4b114b11a3463c33ca0ba9",
+      "bytes": 9887
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-heads.json",
+      "sha256": "8d166a4a518e5b7c24f3e98bcd0c50797d896d188d2d731ac5065c6280bbee91",
+      "bytes": 423
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publish_checkpoint.py",
+      "sha256": "763fac660cf2f2f1cc5e937f751ba99662595631fbc1bcf55309073779c7caa7",
+      "bytes": 2238
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/run_maintenance.py",
+      "sha256": "02a1728772d5c8a6f50a5e0087de74de0e3a9818719bd8ba92042930980d8da8",
+      "bytes": 3777
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json",
+      "sha256": "4da5d5b9eedd5338c58d692a0c6918a6b4a2a46cca98e0b0303bd250d2a6b8a7",
+      "bytes": 1130
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json",
+      "sha256": "55ab3a40f06ca07299d346f5d060509e0a25ddad88b849fb48e504c987328ba1",
+      "bytes": 1133
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json",
+      "sha256": "bd9a555826f65279163a3f8efc346b5b8af82e43824780302eb3617632395eea",
+      "bytes": 189
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/sync_custodian.py",
+      "sha256": "a22c0d6fc2b8e5a6524958817b7ec44dc51288dbed3a6ec6fe8c79785bb2816e",
+      "bytes": 1791
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json",
+      "sha256": "fd8a7d58d9e08b4866420ad77d01fbc7c28c0c2c9610ffbe95ddc77dddd9b1a6",
+      "bytes": 22953
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json",
+      "sha256": "f737ff91b75362ee367441d2fdeb83eed83208d222f592f2942ad62b19bc7b06",
+      "bytes": 7691
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json",
+      "sha256": "0745b5df92d2533714e2a87a43c73b3b685e7bab7bcf4444f7a5fbd82dd4722f",
+      "bytes": 183
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json",
+      "sha256": "09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a",
+      "bytes": 4968
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_close.py",
+      "sha256": "063d711568856163ec8bf4283dec2274238ebce49125dfb6c1d86cebdc62b896",
+      "bytes": 4263
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_owner_bindings.py",
+      "sha256": "aa9ca68b3c0a0922d91f40bd5d4aca77a3f27fa4fdb7e84860981bc287d9adb8",
+      "bytes": 3789
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/watch_rollout.py",
+      "sha256": "a496da3c9a415ac800921ce755446be4bb55bc17e4e6b913143a5d6baf48f815",
+      "bytes": 3274
+    },
+    {
+      "path": "docs/netkingdom-target-implementation.md",
+      "sha256": "02ee43e554f05ad0376271531b4de0699fdb64f97b5b839184eb50283703ba0f",
+      "bytes": 68162
+    },
+    {
+      "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
+      "sha256": "d8723566dbdfd8140b89d7e12ba2aeabf3fdf704b501dd899ab056e440981536",
+      "bytes": 75594
+    }
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publish_checkpoint.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publish_checkpoint.py
new file mode 100644
index 0000000..a35912d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publish_checkpoint.py
@@ -0,0 +1,42 @@
+"""Publish the exact reviewed runtime-return checkpoint through normal hooks."""
+from pathlib import Path
+import hashlib
+import json
+import subprocess
+
+ROOT = Path('/home/worsch/the-custodian')
+BASE = Path(__file__).resolve().parent
+BACKUP = BASE.parent / 'custodian-publication-backup'
+OLD = 'b17e753efc8022fd482e3b2169ba3a604e4bb526'
+
+def git(*args):
+    return subprocess.check_output(['git', '-C', str(ROOT), *args], stderr=subprocess.PIPE)
+
+def preserve():
+    for name, entry in json.loads((BACKUP / 'originals.json').read_text()).items():
+        assert (ROOT / name).read_bytes() == (BACKUP / (name + '.worktree')).read_bytes()
+        assert git('ls-files', '--stage', '--', name).decode() == entry
+    assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin
+               for name, pin in json.loads((BACKUP / 'other-dirty-hashes.json').read_text()).items())
+
+assert git('rev-parse', 'HEAD').decode().strip() == OLD
+preserve()
+manifest = json.loads((BASE / 'publication-inputs.json').read_text())
+paths = [r['path'] for r in manifest['files']] + [str((BASE / 'publication-inputs.json').relative_to(ROOT))]
+for r in manifest['files']:
+    assert hashlib.sha256((ROOT / r['path']).read_bytes()).hexdigest() == r['sha256']
+git('add', '--', *paths)
+result = subprocess.run(['git', '-C', str(ROOT), 'commit', '--only', '-m',
+                         'Record approved API guard delivery and completed owner returns', '--', *paths],
+                        capture_output=True, text=True, timeout=240)
+head = git('rev-parse', 'HEAD').decode().strip()
+receipt = {'status': 'committed' if result.returncode == 0 else 'commit-refused',
+           'commit': head, 'exit_code': result.returncode, 'paths': paths,
+           'stdout': result.stdout, 'stderr': result.stderr, 'unrelated_work_preserved': True}
+(BASE / 'publication-commit.json').write_text(json.dumps(receipt, indent=2) + '\n')
+preserve()
+print(json.dumps({'status': receipt['status'], 'commit': head, 'paths': len(paths),
+                  'unrelated_work_preserved': True}))
+assert result.returncode == 0
+sync = subprocess.run(['python3', str(BASE / 'sync_custodian.py')], timeout=510)
+assert sync.returncode == 0, 'required-sync-failed-receipts-retained'
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/run_maintenance.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/run_maintenance.py
new file mode 100644
index 0000000..35c6c0a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/run_maintenance.py
@@ -0,0 +1,40 @@
+"""Run authorized normal Cluster maintenance with exact client source and retained baseline."""
+from pathlib import Path
+import hashlib,json,subprocess
+here=Path(__file__).resolve().parent;source=here.parent;root=Path('/home/worsch/railiance-cluster')
+packet=source.parent/'netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r6'
+manifest=json.loads((packet/'manifest.json').read_text())
+for name in ['scripts/consistency_check.py']:
+ pin=next(x['candidate_sha256'] for x in manifest['files'] if x['path']==name)
+ assert hashlib.sha256((Path('/home/worsch/state-hub')/name).read_bytes()).hexdigest()==pin,'fixed-client-source-drift'
+assert json.loads((here/'full-rows-before.json').read_text())['status']=='captured_readonly'
+# Verify the installed entrypoint's actual packaged checker, not just checkout bytes.
+probe=subprocess.run(['/home/worsch/state-hub/.venv/bin/python','-c',"import custodian_cli,hashlib,json; p=custodian_cli.STATE_HUB_DIR/'scripts/consistency_check.py'; print(json.dumps({'path':str(p),'sha256':hashlib.sha256(p.read_bytes()).hexdigest()}))"],cwd=root,capture_output=True,text=True,timeout=10)
+assert probe.returncode==0;loaded=json.loads(probe.stdout);assert loaded['sha256']==next(x['candidate_sha256'] for x in manifest['files'] if x['path']=='scripts/consistency_check.py')
+(here/'verified-loaded-client.json').write_text(json.dumps(loaded,indent=2)+'\n')
+baseline_head=subprocess.check_output(['git','-C',str(root),'rev-parse','HEAD'],text=True).strip();assert baseline_head=='6ae3f847c83da3402883453ee7110457bfb2d0d6'
+backup=source/'railiance-cluster-publication-backup';originals=json.loads((backup/'originals.json').read_text())
+def git(*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE)
+for name,index in originals.items():
+ assert (root/name).read_bytes()==(backup/(name+'.worktree')).read_bytes()
+ assert git('ls-files','--stage','--',name).decode()==index
+# Shield original staged generated content from any legacy writeback index.
+for name in originals:
+ raw=git('ls-tree','HEAD','--',name).decode().split();git('update-index','--cacheinfo',raw[0],raw[2],name)
+try:
+ for label,argv,limit in [('verified-client-cluster-consistency',['statehub','fix-consistency','--repo','railiance-cluster','--json'],300),('verified-client-cluster-projection',['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(root),'--push'],180)]:
+  r=subprocess.run(argv,cwd=root,capture_output=True,text=True,timeout=limit)
+  (here/(label+'.json')).write_text(r.stdout);(here/(label+'.stderr.txt')).write_text(r.stderr)
+  assert r.returncode==0,label+'-refused-receipt-retained'
+finally:
+ for name,index in originals.items():
+  (root/name).write_bytes((backup/(name+'.worktree')).read_bytes())
+  mode,oid,stage,path=index.split();assert stage=='0';git('update-index','--cacheinfo',mode,oid,path)
+  assert git('ls-files','--stage','--',name).decode()==index
+c=json.loads((here/'verified-client-cluster-consistency.json').read_text());assert c['summary']['fail']==c['summary']['automation_error']==0
+assert 'bindings: synced 20/20' in c['fixes_applied'],'frozen-binding-omission-not-observed'
+p=json.loads((here/'verified-client-cluster-projection.json').read_text());assert p['status']=='applied'
+assert p['commit']==p['receipt']['expected_commit']==p['receipt']['derived_commit']==baseline_head
+assert p['receipt']['instance_role']=='primary' and p['receipt']['instance_label']=='railiance01'
+assert not p['receipt']['outcome']['refused'] and not p['receipt']['outcome']['retired']
+print(json.dumps({'status':'applied','commit':p['commit'],'fixed_client_source_verified':True,'current_hash_comparison':'pending','original_failed_comparison_retained':True,'unrelated_work_preserved':True}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json
new file mode 100644
index 0000000..4230c3b
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json
@@ -0,0 +1,37 @@
+{
+  "status": "verified",
+  "observed_at": "2026-10-17T01:53:39.422129+00:00",
+  "helm_revision": 77,
+  "target": "railiance01/92.205.62.239",
+  "deployments": [
+    {
+      "deployment": "state-hub",
+      "ready": true,
+      "image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
+      "pod": {
+        "name": "state-hub-6c5b9c676-8chmx",
+        "uid": "a035f7fe-4887-40ab-89a4-3930579073f9"
+      }
+    },
+    {
+      "deployment": "state-hub-mcp",
+      "ready": true,
+      "image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
+      "pod": {
+        "name": "state-hub-mcp-b955b86b4-x849p",
+        "uid": "6641c962-6a74-4019-af66-57d1dee93d21"
+      }
+    }
+  ],
+  "api_pod": {
+    "name": "state-hub-6c5b9c676-8chmx",
+    "uid": "a035f7fe-4887-40ab-89a4-3930579073f9"
+  },
+  "schema": {
+    "status": "ok",
+    "applied": "c4d5e6f7a8b9",
+    "expected": "c4d5e6f7a8b9"
+  },
+  "migration_job_and_pods_absent": true,
+  "primary": "primary/railiance01"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json
new file mode 100644
index 0000000..f450e23
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json
@@ -0,0 +1,37 @@
+{
+  "status": "verified",
+  "observed_at": "2026-10-17T01:52:15.321571+00:00",
+  "helm_revision": 76,
+  "target": "railiance01/92.205.62.239",
+  "deployments": [
+    {
+      "deployment": "state-hub",
+      "ready": true,
+      "image": "forgejo.coulomb.social/coulomb/state-hub:main-51bc70d@sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015",
+      "pod": {
+        "name": "state-hub-65958bd89d-zcmbz",
+        "uid": "77173cfd-14a9-4e30-a26e-08f8a8fbb369"
+      }
+    },
+    {
+      "deployment": "state-hub-mcp",
+      "ready": true,
+      "image": "forgejo.coulomb.social/coulomb/state-hub:main-51bc70d@sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015",
+      "pod": {
+        "name": "state-hub-mcp-76fcddf67d-2c9p7",
+        "uid": "5231c231-437c-44e3-b0ed-12517087b48f"
+      }
+    }
+  ],
+  "api_pod": {
+    "name": "state-hub-65958bd89d-zcmbz",
+    "uid": "77173cfd-14a9-4e30-a26e-08f8a8fbb369"
+  },
+  "schema": {
+    "status": "ok",
+    "applied": "c4d5e6f7a8b9",
+    "expected": "c4d5e6f7a8b9"
+  },
+  "migration_job_and_pods_absent": true,
+  "primary": "primary/railiance01"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json
new file mode 100644
index 0000000..ab8a6b6
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json
@@ -0,0 +1,6 @@
+{
+  "status": "removed-exact-owned-staging",
+  "archive_sha256": "b5c0663d830fc8d3b65080f237a0be8d01f8b2f7fec9dc33aeba91b1b6b281d4",
+  "directory_absent": true,
+  "broad_deletion": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/sync_custodian.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/sync_custodian.py
new file mode 100644
index 0000000..0be4d33
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/sync_custodian.py
@@ -0,0 +1,33 @@
+"""Required consistency/projection with exact restoration of unrelated work."""
+from pathlib import Path
+import hashlib
+import json
+import subprocess
+
+ROOT = Path('/home/worsch/the-custodian')
+BASE = Path(__file__).resolve().parent
+BACKUP = BASE.parent / 'custodian-publication-backup'
+originals = json.loads((BACKUP / 'originals.json').read_text())
+other = json.loads((BACKUP / 'other-dirty-hashes.json').read_text())
+def git(*argv):
+    return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE)
+try:
+    for label, argv, timeout in [
+        ('consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300),
+        ('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'], 180),
+    ]:
+        result = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout)
+        (BASE / ('guard-custodian-' + label + '.json')).write_text(result.stdout)
+        (BASE / ('guard-custodian-' + label + '.stderr.txt')).write_text(result.stderr)
+        assert result.returncode == 0, label + ' failed; receipt retained'
+finally:
+    for name, entry in originals.items():
+        (ROOT / name).write_bytes((BACKUP / (name + '.worktree')).read_bytes())
+        mode, oid, stage, path = entry.split()
+        assert stage == '0'
+        git('update-index', '--cacheinfo', mode, oid, path)
+        assert git('ls-files', '--stage', '--', name).decode() == entry
+    assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin for name, pin in other.items())
+receipt = json.loads((BASE / 'guard-custodian-projection.json').read_text())
+assert receipt['status'] == 'applied'
+print(json.dumps({'status': 'applied', 'commit': receipt['commit'], 'other_work_preserved': True}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json
new file mode 100644
index 0000000..dc89bcf
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json
@@ -0,0 +1,531 @@
+{
+  "repo_slug": "railiance-cluster",
+  "repo_path": "/home/worsch/railiance-cluster",
+  "source_revision": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
+  "source_revision_reason": null,
+  "issues": [
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo",
+      "file_path": ".repo-classification.yaml",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1: task id 'T01' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2: task id 'T02' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3: task id 'T03' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4: task id 'T04' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5: task id 'T05' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1: task id 'T01' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2: task id 'T02' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3: task id 'T03' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4: task id 'T04' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1: task id 'T01' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2: task id 'T02' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3: task id 'T03' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4: task id 'T04' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5: task id 'T05' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6: task id 'T06' is not accepted by the canon kind registry",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1: task 'T01' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1']",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2: task 'T02' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2']",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3: task 'T03' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3']",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4: task 'T04' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4']",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-35",
+      "message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5: task 'T05' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5']",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-33",
+      "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
+      "file_path": "WORK-RECORDS.md",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": true
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-39",
+      "message": "Human wait task 'RCLUSTER-WP-0018-T04' in workplan 'RCLUSTER-WP-0018' has needs_human: true without decision_id \u2014 unrouted human gate",
+      "file_path": "workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md#RCLUSTER-WP-0018-T04",
+      "db_id": "",
+      "file_value": "needs_human: true",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'rail-bs-wp-0008-activity-core-wp0016-triage-output-deploy@retired-20260828' (id=f2ca1a5d\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "f2ca1a5d-4dd6-42ea-8003-969c7265f891",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'rail-bs-wp-0009-activity-core-admin-sync-smoke@retired-20260828' (id=366eec46\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "366eec46-3139-4810-ace6-ea75750fe821",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Closed DB workstream 'rail-bs-wp-0008' (id=5032c55c\u2026, status=finished) has no backing workplan file",
+      "file_path": "",
+      "db_id": "5032c55c-2ee2-4b7e-b1eb-157f0f8ac647",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0014@retired-20260826' (id=a152ddda\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "a152ddda-d60a-4a65-9b9c-59e2db9ff2b7",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0012@retired-20260826' (id=6434f7cb\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "6434f7cb-e13c-4c05-839b-197bb239d5cd",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'railiance-wp-0013@retired-20260826' (id=a3abb83a\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "a3abb83a-2d42-40f9-a5f6-1dbc36903436",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'rail-bs-rcluster-wp-adhoc-2026-07-27@retired-20260828' (id=b37f3c6e\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "b37f3c6e-a9e5-58c2-84ec-77ef2a2978a7",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "INFO",
+      "check_id": "C-08",
+      "message": "Retired DB workstream 'rail-bs-adhoc-2026-07-27@retired-20260828' (id=9a77bc91\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
+      "file_path": "",
+      "db_id": "9a77bc91-f457-5545-996f-04f49707f54b",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "8 unread inbox message(s) older than 3 day(s): railiance-platform:0c1023ce, railiance-platform:f643ce05, prj-forgejo-org-refactor:be06609c, prj-forgejo-org-refactor:6eac8c3f, prj-forgejo-org-refactor:82225aca, ...",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-28",
+      "message": "8 unread message(s) lack thread_id for supersession tracking: railiance-platform:0c1023ce, railiance-platform:f643ce05, prj-forgejo-org-refactor:be06609c, prj-forgejo-org-refactor:6eac8c3f, prj-forgejo-org-refactor:82225aca",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-29",
+      "message": "Unread work request from railiance-platform (f643ce05) may need a workplan file: RPF56: implement native JWT consumer-group mapping for Playwright",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-29",
+      "message": "Unread work request from the-custodian (a1368d99) may need a workplan file: Workplan 'three-phoenix-ha-cluster' is blocked with no wait task",
+      "file_path": "",
+      "db_id": "",
+      "file_value": "",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0007' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/RCLUSTER-WP-0007-threephoenix-ha-cluster.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0007",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0014' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/RCLUSTER-WP-0014-capacity-utilization-and-allocation-evidence.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0014",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0016' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0016",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0017' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0017",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0018' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0018",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0001' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260622-RCLUSTER-WP-0001-activity-core-cluster-owned-deploy-verify.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0001",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0002' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260622-RCLUSTER-WP-0002-activity-core-verifier-evidence-hardening.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0002",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-26",
+      "message": "Workplan id 'RCLUSTER-WP-0003' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
+      "file_path": "workplans/archived/260701-RCLUSTER-WP-0003-activity-core-llm-connect-live-reconcile.md",
+      "db_id": "",
+      "file_value": "RCLUSTER-WP-0003",
+      "db_value": "RAIL-BS-WP",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0008' collides across repos: railiance-bootstrap/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md, railiance-cluster/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md",
+      "file_path": "workplans/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0008",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0009' collides across repos: railiance-bootstrap/RAIL-BS-WP-0009-activity-core-admin-sync-smoke.md, railiance-cluster/RAIL-BS-WP-0009-activity-core-admin-sync-smoke.md",
+      "file_path": "workplans/RAIL-BS-WP-0009-activity-core-admin-sync-smoke.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0009",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0001' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0001-dependency-management.md, railiance-cluster/260622-RAIL-BS-WP-0001-dependency-management.md",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0001-dependency-management.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0001",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0002' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0002-k3s-baseline.md, railiance-cluster/260622-RAIL-BS-WP-0002-k3s-baseline.md",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0002",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0003' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md, railiance-cluster/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0003",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0004' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0004-safety-net.md, railiance-cluster/260622-RAIL-BS-WP-0004-safety-net.md",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0004",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0005' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0005-kubeconfig-delivery.md, railiance-cluster/260622-RAIL-BS-WP-0005-kubeconfig-delivery.md",
+      "file_path": "workplans/archived/260622-RAIL-BS-WP-0005-kubeconfig-delivery.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0005",
+      "db_value": "",
+      "fixable": false
+    },
+    {
+      "severity": "WARN",
+      "check_id": "C-27",
+      "message": "Workplan id 'RAIL-BS-WP-0006' collides across repos: railiance-bootstrap/260627-RAIL-BS-WP-0006-staged-promotion-lifecycle.md, railiance-cluster/260627-RAIL-BS-WP-0006-staged-promotion-lifecycle.md",
+      "file_path": "workplans/archived/260627-RAIL-BS-WP-0006-staged-promotion-lifecycle.md",
+      "db_id": "",
+      "file_value": "RAIL-BS-WP-0006",
+      "db_value": "",
+      "fixable": false
+    }
+  ],
+  "fixes_applied": [
+    "bindings: synced 20/20",
+    "C-33 fixed: regenerated WORK-RECORDS.md",
+    "brief: .custodian-brief.md updated",
+    "push: pushed"
+  ],
+  "summary": {
+    "fail": 0,
+    "automation_error": 0,
+    "warn": 43,
+    "info": 8
+  },
+  "result": "warn"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json
new file mode 100644
index 0000000..600182f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json
@@ -0,0 +1,246 @@
+{
+  "ok": true,
+  "status": "applied",
+  "repo_slug": "railiance-cluster",
+  "commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
+  "requests": 2,
+  "elapsed_ms": 1555.4,
+  "git": {
+    "upstream": "origin/main",
+    "behind": 0,
+    "ahead": 0
+  },
+  "identifiers": {
+    "schema": "repo-manager.identifier-assignment.v1",
+    "ok": true,
+    "executed": true,
+    "repo": "railiance-cluster",
+    "namespace": "helixforge",
+    "assignments": [],
+    "historical_invalid_identifiers": [
+      {
+        "kind": "task",
+        "id": "T01",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1"
+      },
+      {
+        "kind": "task",
+        "id": "T02",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2"
+      },
+      {
+        "kind": "task",
+        "id": "T03",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3"
+      },
+      {
+        "kind": "task",
+        "id": "T04",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4"
+      },
+      {
+        "kind": "task",
+        "id": "T05",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5"
+      },
+      {
+        "kind": "task",
+        "id": "T01",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1"
+      },
+      {
+        "kind": "task",
+        "id": "T02",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2"
+      },
+      {
+        "kind": "task",
+        "id": "T03",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3"
+      },
+      {
+        "kind": "task",
+        "id": "T04",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4"
+      },
+      {
+        "kind": "task",
+        "id": "T01",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1"
+      },
+      {
+        "kind": "task",
+        "id": "T02",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2"
+      },
+      {
+        "kind": "task",
+        "id": "T03",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3"
+      },
+      {
+        "kind": "task",
+        "id": "T04",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4"
+      },
+      {
+        "kind": "task",
+        "id": "T05",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5"
+      },
+      {
+        "kind": "task",
+        "id": "T06",
+        "source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6"
+      }
+    ],
+    "historical_identity_collisions": [
+      {
+        "kind": "task",
+        "id": "T01",
+        "uuid": null,
+        "sources": [
+          "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1",
+          "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1",
+          "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1"
+        ],
+        "parent_id": "RAIL-BS-WP-0002",
+        "uuids": [
+          "3f042630-eab0-4c6a-9167-e2b28ff20e40",
+          "4526a842-ea31-4874-9231-92ab556cfe7b",
+          "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
+        ]
+      },
+      {
+        "kind": "task",
+        "id": "T02",
+        "uuid": null,
+        "sources": [
+          "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2",
+          "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2",
+          "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2"
+        ],
+        "parent_id": "RAIL-BS-WP-0002",
+        "uuids": [
+          "a6313e06-1976-46a7-8e31-df4eb2eca880",
+          "ab166073-30a7-4702-a037-4091e8706e20",
+          "e8510646-46ed-4697-a345-f3d3009eea78"
+        ]
+      },
+      {
+        "kind": "task",
+        "id": "T03",
+        "uuid": null,
+        "sources": [
+          "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3",
+          "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3",
+          "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3"
+        ],
+        "parent_id": "RAIL-BS-WP-0002",
+        "uuids": [
+          "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3",
+          "140da396-8e30-4f4d-b88c-c42c0cd46c01",
+          "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
+        ]
+      },
+      {
+        "kind": "task",
+        "id": "T04",
+        "uuid": null,
+        "sources": [
+          "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4",
+          "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4",
+          "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4"
+        ],
+        "parent_id": "RAIL-BS-WP-0002",
+        "uuids": [
+          "08233868-d522-4117-bc4e-6c0f52545665",
+          "5c3d40e4-239b-488e-9519-6f7a38d2325f",
+          "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
+        ]
+      },
+      {
+        "kind": "task",
+        "id": "T05",
+        "uuid": null,
+        "sources": [
+          "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5",
+          "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5"
+        ],
+        "parent_id": "RAIL-BS-WP-0002",
+        "uuids": [
+          "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8",
+          "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
+        ]
+      }
+    ],
+    "files_changed": []
+  },
+  "receipt": {
+    "schema": "state-hub.repository-projection-reconcile.v1",
+    "outcome": {
+      "notes": [
+        "Preserved bound historical row and task UUIDs: RAIL-BS-WP-0002",
+        "Preserved bound historical row and task UUIDs: RAIL-BS-WP-0003",
+        "Preserved bound historical row and task UUIDs: RAIL-BS-WP-0004"
+      ],
+      "commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
+      "counts": {
+        "created": 0,
+        "refused": 0,
+        "retired": 0,
+        "updated": 20,
+        "released": 0,
+        "created_edges": 0,
+        "created_tasks": 0,
+        "removed_edges": 0,
+        "updated_tasks": 1,
+        "external_edges": 0,
+        "cancelled_tasks": 0,
+        "unresolved_edges": 0
+      },
+      "schema": "state-hub.projection-reset.v1",
+      "status": "applied",
+      "created": [],
+      "refused": [],
+      "retired": [],
+      "updated": [
+        "RAIL-BS-WP-0001",
+        "RAIL-BS-WP-0005",
+        "RAIL-BS-WP-0006",
+        "RAIL-BS-WP-0008",
+        "RAIL-BS-WP-0009",
+        "RAIL-BS-WP-0010",
+        "RAIL-BS-WP-0011",
+        "RAIL-BS-WP-0012",
+        "RAIL-BS-WP-0013",
+        "RAIL-BS-WP-0014",
+        "RAIL-BS-WP-0015",
+        "RCLUSTER-WP-0001",
+        "RCLUSTER-WP-0002",
+        "RCLUSTER-WP-0003",
+        "RCLUSTER-WP-0007",
+        "RCLUSTER-WP-0014",
+        "RCLUSTER-WP-0016",
+        "RCLUSTER-WP-0017",
+        "RCLUSTER-WP-0018",
+        "RCLUSTER-WP-ADHOC-2026-07-27"
+      ],
+      "released": [],
+      "repo_slug": "railiance-cluster",
+      "created_edges": [],
+      "created_tasks": [],
+      "removed_edges": [],
+      "updated_tasks": [
+        "RCLUSTER-WP-0018-T01"
+      ],
+      "external_edges": [],
+      "cancelled_tasks": [],
+      "unresolved_edges": []
+    },
+    "instance_role": "primary",
+    "derived_commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
+    "instance_label": "railiance01",
+    "expected_commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6"
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json
new file mode 100644
index 0000000..5a54f8f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json
@@ -0,0 +1,4 @@
+{
+  "path": "/home/worsch/state-hub/.venv/lib/python3.12/site-packages/scripts/consistency_check.py",
+  "sha256": "1bfbc89d3ff5c621ec541fd32384083cc7dcf96a639b217d62b6fc34de238efd"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json
new file mode 100644
index 0000000..c148fd2
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json
@@ -0,0 +1,96 @@
+{
+  "schema": "state95.guard-successor-verified-return.v1",
+  "status": "verified",
+  "verified_at": "2026-10-17T01:55:19.742775+00:00",
+  "proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
+  "executed_revision": 2,
+  "executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
+  "approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
+  "helm_revision": 77,
+  "deployed_source": "c103cbf3c8bed5dba87a03e320595ddded9301a3",
+  "deployed_image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
+  "schema_expected_and_applied": "c4d5e6f7a8b9",
+  "api_mcp_ready": true,
+  "actual_native_cases_passed": 8,
+  "actual_commits_in_probes": 0,
+  "current_full_historical_rows_preserved": 18,
+  "frozen_archives_unchanged": 3,
+  "normal_loaded_client_pipeline": "passed20ordinarybindings3frozenomitted",
+  "exact_job_uid": "99ebab16-f0e7-49ac-8db3-b3b34f7331df",
+  "observed_owned_pod_succeeded": true,
+  "job_and_owned_pods_absent_after": true,
+  "exact_owned_chart_staging_removed": true,
+  "recovery_required": false,
+  "original_three_parent_failure_disposition": "Founder approved current-baseline successor acceptance; original failure retained as historicalexception, unavailable preimages notguessed/restored and no backfilledsuccess.",
+  "native_security_target_gates_closed": 0,
+  "bound_receipts": [
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json",
+      "sha256": "f7b12514c52f815854c5bcda8b41fdfef34ee8488c8d4ec779cfc41ae6493d7e"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json",
+      "sha256": "55ab3a40f06ca07299d346f5d060509e0a25ddad88b849fb48e504c987328ba1"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json",
+      "sha256": "a296873b93c18a31068f1c41c3600d681c2829c00fb6fb458ce6faa5f3718c27"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json",
+      "sha256": "2bfb02130876aeb71a773585dae8b446ad5c671050ebc14d0fc7bcce86dffea5"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json",
+      "sha256": "bd6f1629bc44858dd914ae33c94e72ef4cbd1893c1ff164c5bbf27db02d1d3b8"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json",
+      "sha256": "b772cb147a2ee18eecfa39fc8eda0fe92b6cec35a1f302bbe3da024ae6e06d5c"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json",
+      "sha256": "af4d48460996dadb460f9a01a33fc6b06dfcd762b36a34dbac078a758ea94ac6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json",
+      "sha256": "dc2d959cdcc342395fc53a2e316f6d95b650d6526343a7b07eb8fdc90570c12a"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json",
+      "sha256": "4da5d5b9eedd5338c58d692a0c6918a6b4a2a46cca98e0b0303bd250d2a6b8a7"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json",
+      "sha256": "682cc03c42af5b9be1046390b2f50b83b3e5cad6fb2f89d51740a768706e8489"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json",
+      "sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json",
+      "sha256": "0745b5df92d2533714e2a87a43c73b3b685e7bab7bcf4444f7a5fbd82dd4722f"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json",
+      "sha256": "fd8a7d58d9e08b4866420ad77d01fbc7c28c0c2c9610ffbe95ddc77dddd9b1a6"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json",
+      "sha256": "f737ff91b75362ee367441d2fdeb83eed83208d222f592f2942ad62b19bc7b06"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json",
+      "sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json",
+      "sha256": "bd9a555826f65279163a3f8efc346b5b8af82e43824780302eb3617632395eea"
+    },
+    {
+      "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json",
+      "sha256": "95995c0184c707238d531d5113ae3798ef66051a507bf5a0b70af2966900b217"
+    }
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_close.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_close.py
new file mode 100644
index 0000000..083aa5f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_close.py
@@ -0,0 +1,71 @@
+"""Verify final canonical publication, source task bindings and retained proofs."""
+from pathlib import Path
+import hashlib
+import json
+import re
+import subprocess
+import urllib.request
+import yaml
+
+ROOT = Path('/home/worsch/the-custodian')
+BASE = Path(__file__).resolve().parent
+BACKUP = BASE.parent / 'custodian-publication-backup'
+
+def git(*args):
+    return subprocess.check_output(['git', '-C', str(ROOT), *args], stderr=subprocess.PIPE).decode().strip()
+
+def get(path):
+    return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=20))
+
+head = git('rev-parse', 'HEAD')
+assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == head
+projection = json.loads((BASE / 'guard-custodian-projection.json').read_text())
+assert projection['status'] == 'applied' and projection['commit'] == head
+receipt = projection['receipt']
+assert receipt['expected_commit'] == receipt['derived_commit'] == head
+assert receipt['instance_role'] == 'primary' and receipt['instance_label'] == 'railiance01'
+path = ROOT / 'workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md'
+raw = path.read_text()
+assert git('show', head + ':' + str(path.relative_to(ROOT))) == raw.strip()
+front = yaml.safe_load(raw.split('---', 2)[1])
+tasks = [yaml.safe_load(v) for v in re.findall(r'```task\n(.*?)\n```', raw, re.S)]
+assert len(tasks) == 6 and front['status'] == 'active'
+snapshot = get('/repos/the-custodian/work-record-projection/snapshot')
+plan = next(p for p in snapshot['workplans'] if p['id'] == front['state_hub_workstream_id'])
+assert plan['status'] == 'active'
+actual = {t['id']:t for t in snapshot['tasks'] if t.get('workplan_id', t.get('workstream_id')) == plan['id']}
+assert len(actual) == len(tasks)
+for task in tasks:
+    row = actual[task['state_hub_task_id']]
+    assert row['record_id'] == task['id'] and row['status'] == task['status']
+for name, entry in json.loads((BACKUP / 'originals.json').read_text()).items():
+    assert (ROOT / name).read_bytes() == (BACKUP / (name + '.worktree')).read_bytes()
+    assert git('ls-files', '--stage', '--', name) == entry.strip()
+assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin
+           for name,pin in json.loads((BACKUP / 'other-dirty-hashes.json').read_text()).items())
+decision = get('/decisions/df703266-6719-4c04-ae1b-ba9afd3bca1c')
+assert decision['status'] == 'resolved' and decision['decision_type'] == 'made' and decision['decided_by'] == 'Bernd Worsch'
+proposal = BASE.parent / 'guard-successor-review-r2/proposal-metadata.json'
+assert hashlib.sha256(proposal.read_bytes()).hexdigest() == '5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e'
+for r in json.loads(proposal.read_text())['bound_receipts']:
+    assert hashlib.sha256(Path(r['path']).read_bytes()).hexdigest() == r['sha256']
+returned = BASE / 'verified-receiving-return.json'
+assert hashlib.sha256(returned.read_bytes()).hexdigest() == '09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a'
+for r in json.loads(returned.read_text())['bound_receipts']:
+    assert hashlib.sha256((ROOT / r['path']).read_bytes()).hexdigest() == r['sha256']
+owners = json.loads((BASE / 'owner-bindings.json').read_text())
+assert owners['status'] == 'verified' and owners['task_bindings'] == 26
+for row in owners['rows']:
+    if row['workplan_id'] in ['STATE-WP-0095', 'RMGR-WP-0019']:
+        assert row['status'] == 'finished' and all(t['status'] == 'done' and not t.get('needs_human') for t in row['tasks'])
+manifest = json.loads((BASE / 'publication-inputs.json').read_text())
+for r in manifest['files']:
+    committed = subprocess.check_output(['git', '-C', str(ROOT), 'show', head + ':' + r['path']], stderr=subprocess.PIPE)
+    assert hashlib.sha256(committed).hexdigest() == r['sha256']
+result = {'status':'verified', 'commit':head, 'remote_exact':True,
+          'primary_projection_expected_equals_derived':True, 'task_bindings':32,
+          'state95_and_registrar19_finished':True, 'approved_revision':2,
+          'runtime_return_and_proposal_bound_receipts_unchanged':True,
+          'unrelated_index_and_worktree_preserved':True, 'native_target_gates_closed':0}
+(BASE / 'close-verification.json').write_text(json.dumps(result,indent=2)+'\n')
+print(json.dumps(result))
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_owner_bindings.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_owner_bindings.py
new file mode 100644
index 0000000..ec3d145
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_owner_bindings.py
@@ -0,0 +1,34 @@
+"""Read-only final source/remote/Hub binding check, retaining only public identifiers."""
+from pathlib import Path
+import hashlib,json,re,subprocess,urllib.request,yaml
+here=Path(__file__).resolve().parent
+specs=json.loads((here/'owner-heads.json').read_text())
+def git(root,*a):return subprocess.check_output(['git','--no-optional-locks','-C',str(root),*a],stderr=subprocess.PIPE,timeout=30).decode().strip()
+def get(path):return json.load(urllib.request.urlopen('http://127.0.0.1:8000'+path,timeout=20))
+health=get('/state/health');assert health['instance_role']=='primary' and health['instance_label']=='railiance01'
+rows=[];snapshots={};targets={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
+for repo,wp,head,count in specs:
+ root=Path('/home/worsch')/repo;assert git(root,'rev-parse','HEAD')==head
+ paths=list((root/'workplans').glob(wp+'-*.md'));assert len(paths)==1;path=paths[0];raw=path.read_text();assert git(root,'show',head+':'+str(path.relative_to(root)))==raw.strip()
+ front=yaml.safe_load(raw.split('---',2)[1]);tasks=[yaml.safe_load(v) for v in re.findall(r'```task\n(.*?)\n```',raw,re.S)];assert len(tasks)==count
+ for task in tasks:targets[task['id']]=task['state_hub_task_id']
+ rows.append(dict(repo=repo,wp=wp,head=head,source_path=str(path),front=front,tasks=tasks,source_sha256=hashlib.sha256(path.read_bytes()).hexdigest()))
+result=[]
+for item in rows:
+ repo=item['repo'];root=Path('/home/worsch')/repo
+ remote=git(root,'ls-remote','origin','refs/heads/main').split()[0];assert remote==item['head']
+ snapshot=snapshots.setdefault(repo,get('/repos/'+repo+'/work-record-projection/snapshot'))
+ plan=next(p for p in snapshot['workplans'] if p['id']==item['front']['state_hub_workstream_id']);assert plan['status']==item['front']['status']
+ actual=[t for t in snapshot['tasks'] if t.get('workplan_id',t.get('workstream_id'))==plan['id']];assert len(actual)==len(item['tasks']);byid={t['id']:t for t in actual}
+ for task in item['tasks']:
+  t=byid[task['state_hub_task_id']];assert t['record_id']==task['id'] and t['status']==task['status']
+  if 'needs_human' in task:assert bool(t.get('needs_human'))==task['needs_human']
+ expected={(t['state_hub_task_id'],targets[d],'starts_after') for t in item['tasks'] for d in t.get('depends_on',[]) if d in targets}
+ edges=[e for e in snapshot['dependencies'] if e['from_workplan_id']==plan['id'] and e.get('from_task_id')]
+ observed={(e['from_task_id'],e.get('to_task_id'),e['relationship_type']) for e in edges}
+ assert observed<=expected,'undeclared-projected-edge'
+ required_pairs={'RCLUSTER-WP-0018':[('RCLUSTER-WP-0018-T03','RCLUSTER-WP-0018-T02'),('RCLUSTER-WP-0018-T04','RCLUSTER-WP-0018-T02'),('RCLUSTER-WP-0018-T04','RCLUSTER-WP-0018-T03')]}
+ assert all((targets[a],targets[b],'starts_after') in observed for a,b in required_pairs.get(item['wp'],[])),'required-current-edge-missing'
+ result.append({'repo':repo,'workplan_id':item['wp'],'commit':item['head'],'remote_exact':True,'source_sha256':item['source_sha256'],'status':plan['status'],'tasks':[{k:t[k] for k in ['id','record_id','status','needs_human'] if k in t} for t in actual],'projected_edges':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(observed)],'unprojected_source_declarations':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(expected-observed)]})
+v={'schema':'custodian.rollout-owner-bindings.v1','status':'verified','primary':'primary/railiance01','task_bindings':sum(len(r['tasks']) for r in result),'rows':result,'runtime_deployed_source':'c103cbf3c8bed5dba87a03e320595ddded9301a3','helm_revision':77,'native_target_gates_closed':0}
+(here/'owner-bindings.json').write_text(json.dumps(v,indent=2)+'\n');print(json.dumps({'status':'verified','task_bindings':v['task_bindings']}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/watch_rollout.py b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/watch_rollout.py
new file mode 100644
index 0000000..c680ddc
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/watch_rollout.py
@@ -0,0 +1,57 @@
+"""Observe the approved release Job and owned Pods; never mutate resources."""
+from pathlib import Path
+from datetime import datetime, timezone
+import json
+import subprocess
+import time
+
+BASE = Path(__file__).resolve().parent
+KUBE = ['kubectl', '--kubeconfig', '/home/worsch/.kube/config-railiance01', '-n', 'state-hub']
+IMAGE = 'forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1'
+def get(args):
+    result = subprocess.run(KUBE + args, capture_output=True, timeout=10)
+    if result.returncode:
+        return None
+    return json.loads(result.stdout) if result.stdout.strip() else {}
+
+result = {'schema': 'state95.approved-job-observation.v1', 'mutation': False,
+          'started_at': datetime.now(timezone.utc).isoformat(), 'jobs': {}, 'poll_failures': 0}
+deadline = time.monotonic() + 240
+while time.monotonic() < deadline:
+    try:
+        job = get(['get', 'job', 'state-hub-migrate', '--ignore-not-found', '-o', 'json'])
+        if job is None:
+            result['poll_failures'] += 1
+        elif job:
+            meta = job['metadata']
+            images = [c['image'] for c in job['spec']['template']['spec']['containers']]
+            if (images != [IMAGE] or meta.get('labels', {}).get('app.kubernetes.io/instance') != 'state-hub'
+                    or meta.get('labels', {}).get('app.kubernetes.io/managed-by') != 'Helm'
+                    or meta.get('annotations', {}).get('helm.sh/hook') != 'pre-install,pre-upgrade'):
+                result['unexpected_job_identity'] = True
+                break
+            entry = result['jobs'].setdefault(meta['uid'], {'uid': meta['uid'], 'name': meta['name'],
+                'created_at': meta['creationTimestamp'], 'image': IMAGE, 'managed_by': 'Helm',
+                'release': 'state-hub', 'hook': 'pre-install,pre-upgrade', 'pods': {}})
+            entry['last_status'] = {k: job.get('status', {}).get(k) for k in ['active', 'succeeded', 'failed']}
+            pods = get(['get', 'pods', '-l', 'job-name=state-hub-migrate', '-o', 'json'])
+            if pods:
+                for pod in pods['items']:
+                    owners = pod['metadata'].get('ownerReferences', [])
+                    if not any(o['uid'] == meta['uid'] and o['kind'] == 'Job' for o in owners):
+                        continue
+                    entry['pods'][pod['metadata']['uid']] = {'name': pod['metadata']['name'],
+                        'uid': pod['metadata']['uid'], 'owner_job_uid': meta['uid'],
+                        'pod_ip': pod.get('status', {}).get('podIP'), 'phase': pod.get('status', {}).get('phase')}
+        elif result['jobs']:
+            result['job_absent_after_observation'] = True
+        (BASE / 'job-observation.json').write_text(json.dumps(result, indent=2) + '\n')
+        if (BASE / 'helm-return.json').exists():
+            result['helm_return_observed'] = True
+            break
+    except (subprocess.TimeoutExpired, ValueError, KeyError):
+        result['poll_failures'] += 1
+    time.sleep(0.7)
+result['ended_at'] = datetime.now(timezone.utc).isoformat()
+(BASE / 'job-observation.json').write_text(json.dumps(result, indent=2) + '\n')
+print(json.dumps({'observed_trial_jobs': len(result['jobs']), 'mutation': False}))
diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md
index 46123d0..d2d6f60 100644
--- a/docs/netkingdom-target-implementation.md
+++ b/docs/netkingdom-target-implementation.md
@@ -903,3 +903,32 @@ All sixteen native target gates remain open.
 The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained.
 
 The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`.
+
+
+## Approved API guard delivered and verified, 2026-10-17
+
+The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2,
+SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`,
+through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned
+`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1`
+image is delivered at Helm 77. API and MCP are Ready; applied/expected schema
+remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone,
+and only the verified owned chart staging was removed. No recovery was needed.
+
+All eight deployed owner-handler cases passed with enforced commit interception,
+rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline
+passes with the verified installed checker: 20/20 ordinary bindings, three frozen
+bindings omitted, and all eighteen CURRENT historical full rows unchanged across
+the rollout, native probes and maintenance. All three frozen archives and
+unrelated staged/worktree state are preserved. The earlier three-parent mismatch
+remains a founder-approved historical exception: unavailable old preimages were
+not guessed, restored or relabeled as a passing result. Runtime acceptance is
+separate from all sixteen NetKingdom native target gates, which remain open.
+
+Frozen acceptance return:
+`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`,
+SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`.
+The supervision record retains original revision 1, the approved/executed revision
+2, exact digests and successful refined outcome; it grants no autopilot authority.
+
+Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken.
diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
index d01ba58..9eb014d 100644
--- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
+++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
@@ -1092,3 +1092,32 @@ All sixteen native target gates remain open.
 The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained.
 
 The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`.
+
+
+## Approved API guard delivered and verified, 2026-10-17
+
+The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2,
+SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`,
+through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned
+`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1`
+image is delivered at Helm 77. API and MCP are Ready; applied/expected schema
+remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone,
+and only the verified owned chart staging was removed. No recovery was needed.
+
+All eight deployed owner-handler cases passed with enforced commit interception,
+rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline
+passes with the verified installed checker: 20/20 ordinary bindings, three frozen
+bindings omitted, and all eighteen CURRENT historical full rows unchanged across
+the rollout, native probes and maintenance. All three frozen archives and
+unrelated staged/worktree state are preserved. The earlier three-parent mismatch
+remains a founder-approved historical exception: unavailable old preimages were
+not guessed, restored or relabeled as a passing result. Runtime acceptance is
+separate from all sixteen NetKingdom native target gates, which remain open.
+
+Frozen acceptance return:
+`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`,
+SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`.
+The supervision record retains original revision 1, the approved/executed revision
+2, exact digests and successful refined outcome; it grants no autopilot authority.
+
+Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken.