Record bounded outbox, installed routing, package identity and audit admission progress

docs/netkingdom-target-implementation.md

@@ -203,24 +203,64 @@ the exact custody decision. No key, credential grant or live deployment was made
 Use existing owner paths and retain the deployed lifecycle policy while preparing
 the first native acceptance package. The task-execution pilot remains unadmitted.
 
+The next four source slices are published and their committed file hashes match
+the reviewed receipts: Access `0a05383` (bounded durable outbox and process locking),
+Warden `d79f065` (attended administration routing), Secrets `3718e60` (reproducible
+CLI release and admission requirements), and Platform `a3e8eb6` (phase-aware
+attended signer adapter). Independent checks passed the Access race/chart suites,
+135 Warden tests and 56 Platform tests. Secrets' two release builds were identical;
+a clean offline installation and pre-credential trust refusal passed. These are
+source and isolated-runtime proofs, not production admission.
+
+The installed Warden CLI now matches the reviewed routing module and preserves
+phase-memory. Its actual plan selects `openbao-platform-admin-login`, with
+`founder_required` and `oidc_login`. The previous routing defect is resolved;
+the attended identity act and exact custody proposal remain required.
+
+Access's new canonical local thin package is committed at `d52f811` with the
+reviewed thirteen-file tree. The exact local resolver identifies
+`rapp-flex-auth-secrets-engine` / `flex-auth-secrets-engine` /
+`flex-auth-secrets-engine`, owned by Access and still draft. Family review passed;
+the global check retains the pre-existing Forgejo declaration error and reef
+warning. Remote publication, central onboarding, placement and runtime admission
+remain separate. Its frozen extraction source/image do not activate the signer.
+
+The normal Access image run400 published source `0a05383`, then failed during
+receipt parsing because the runner lacks Python. Public package metadata and the
+run's push/pull evidence identify the published digest and exact revision; the
+failed run remains failed. Access `84c78e0` replaces that parser with existing
+Bash/Docker facilities, verifies the pulled revision label, and records the local
+package reference. Three independent publisher tests pass. Normal source publication and synchronization passed; successor CI is being
+observed. No deployment follows automatically.
+
+Audit `64509d2` defines the first pin's admission and complete-ledger reconciliation
+using existing receiver APIs. Independent root checks passed 17 tests plus the
+canonical cross-owner fixture; one isolated-checkout skip is retained. Bounded
+reconciliation requires independently retained complete producer ledger bytes,
+every-ID readback and all-class acceptance-time counts, with concurrent boundary
+arrivals settled. Selected successful IDs are insufficient. The initial signer
+slice keeps audit delivery disabled; periodic independent custody, final per-pin
+cadence, receiver admission and runtime observation remain required.
+
 - Access owns an immutable image, signer projection, retained caller binding and
   durable outbox. Metadata inspection found no existing namespace PVC. A proposed
   1 GiB local-path claim is new storage; its requested capacity is not a filesystem
   quota. OS-enforced single-writer locking, bounded append/startup and fail-closed
-  storage failure behavior are being implemented in the existing outbox. Recreate
+  storage failure behavior are published in the existing outbox. Recreate
   with one pod alone does not establish those properties.
 - Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended
   signer writing, fencing and private recovery receipts. Native role naming must
-  satisfy the real delegated-applier policy. The current free-text Warden plan
-  selected a survey route instead of the required admin-login route; preserve that
-  dispatch mismatch as a blocker rather than silently choosing another credential.
+  satisfy the real delegated-applier policy. The installed Warden plan now selects
+  the required admin-login route. The phase-aware writer preserves metadata-only
+  and seed-write uncertainty; recovery is read-only and cannot authorize replay.
 - Secrets owns the release bundle, fixed verifier, independently admitted public
   trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY
   capture are preparatory evidence; they do not establish effects at the inventoried
   eleven privileged call sites across ten handlers. Those effects remain unaccepted.
-- Retained Access deployment lacks an established managed-package identity tuple.
-  Resolve that with the package owner; another application's declaration cannot
-  supply its authority. Native audit receiver reconciliation also remains required.
+- The retained Access tuple now resolves against its committed local declaration.
+  Resolve availability for each actual admission consumer separately; a local
+  checkout does not establish central registration, placement or runtime trust.
+  Native audit receiver reconciliation also remains required.
 
 The [source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json)
 records exact publication and synchronization results. Temporary review checkouts