--- a/workplans/NK-WP-0048-security-case-types.md
+++ b/workplans/NK-WP-0048-security-case-types.md
@@ -708,6 +708,34 @@
 without the trusted integration. SQLite remains local/disposable only; any
 production exception requires explicit scoped governance under ADR-0015.
 
+2026-10-17 owner-integration refinement: T23 records the completed source/package
+placement review, distinct from T21's source/disposable-SQL proof. Its dedicated
+`rapp-identity-provisioner` recommendation is draft and unbound, not an accepted
+package or existing repository. The full six-consumer rapp-postgres renderer
+accepts the inert candidate on platform-pg-2 as its third of four declared
+consumers; first-cell placement is refused as a fifth. Neither the estimated
+four-consumer ceiling nor source requests establish native headroom or backup.
+
+Next independent owner contracts: NetKingdom/package/substrate owners accept
+exact deployment/rollback fate; rapp-postgres admits the dedicated consumer,
+roles, five-connection budget and actual backup/restore; Platform admits exact
+renewable runtime/migration delivery and TLS/CA/SAN; network owners scope SQL,
+broker and checkpoint paths without assuming a narrow policy subtracts additive
+same-namespace access. Protected caller owners must provide authoritative
+GroupJournalBinding construction and current authorization; an independent
+existing holder must authenticate and atomically advance the exact content
+checkpoint, not a counter or ordinary Audit receipt. Directory/runtime owners
+must select and prove either an exclusive all-writer maintenance barrier or
+provider-supported CAS/generation, including established sessions, lifecycle
+cascades and remove/readd ABA. No source review establishes those owner facts.
+
+The default PostgreSQL activation and destructive native rollback remain refused.
+Storage/lease acceptance can be proposed separately from LDAP mutation only after
+exact owner source/target/custody/verification/recovery and cost/risk review;
+State Hub guard approval grants none of it. Source-only integration review and
+native acceptance matrix: Custodian native-storage-r1/OWNER-REVIEW.md. T14's
+existing status, UUID, dependencies and native completion gate are retained.
+
 2026-10-17 refinement: T20 retains the historical durable SQLite source and
 actual disposable LLDAP proof. T21 extracts the completed PostgreSQL source and
 bounded real disposable SQL compatibility proof. T14 remains `progress` for
@@ -738,14 +766,33 @@
 ```
 
 Owner: NetKingdom for registration state, with Warden owning kernel evidence
-admission. Next action: select the exact existing owner evidence holder/readback
-contract and define authenticated lookup for the original creation attempt.
-Completion requires restart/lost-receipt fixtures that bind case/source/principal,
-original created-only provenance and current native revision before any undo;
-uncertain outcomes remain non-replayable. The T13 adapter deliberately refuses
-post-restart rollback and installs no reconciliation callback. A new broker or
-unverified JSON receipt is not a recovery contract. Actual evidence-holder
-acceptance and attended recovery remain separately authorized native work.
+admission. T22 records the completed source review and exact existing-seam gaps;
+T15 retains implementation and authenticated restart/lost-receipt acceptance.
+Next action: identify the actual owner publisher/authenticator and bounded
+original-attempt readback contract, and obtain Warden's reviewed original-intent
+lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
+retains attempt identity in historical rows but only hashes evidence references;
+load drops that context and reconcile passes a fresh attempt to the callback.
+The adapter's original payload and creation record remain process-local. Neither
+that journal nor a current matching registry entry reconstructs creation authority.
+
+The owner contract must bind the original Invocation, case/type/descriptor/catalog/
+acceptance pins, source, principal and admitted tenant/realm provenance, separately
+from the new reconciliation attempt and its independently revoked parent session.
+Use an existing authenticated holder/readback; Audit Core's custody API is a
+candidate only until its actual registration source/class, load-bearing emission
+contract and separate scoped reader are admitted. No new broker or receipt trust
+root is proposed. A missing original record, ambiguous publication, NO_CHANGE,
+changed native revision or lost readback stays uncertain; no add replay or undo.
+
+Completion requires restart/lost-receipt fixtures against the selected actual owner
+contract: independently authenticated original created-only provenance, original
+exact client entry and unchanged current postcreation UID/resourceVersion before
+any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
+The T13 adapter deliberately refuses post-restart rollback and installs no
+reconciliation callback. Existing source review, JSON receipts and synthetic
+trust do not satisfy native holder acceptance or authorize attended recovery.
+Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
 
 ## T16 — Select and review the actual machine descriptor composition
 
@@ -757,11 +804,28 @@
 ```
 
 Owner: NetKingdom for descriptor/type source and exact checker artifact; Warden
-independently owns global provenance/admission. Next action: obtain review of the
-exact checker source/artifact proposed by T17 and identify native owner evidence/
-session callback contracts, then assemble the complete step descriptor set and
-a proposed explicit type version selection. T13's historical descriptor retains
-its synthetic checker; T17 supplies an artifact-bound proposal, not admission.
+independently owns global provenance/admission. T22 records the completed seven-step
+source1.2 inventory and regenerated register-client descriptor using the delivered
+checker and current sealed-snapshot source; T16 retains exact owner review,
+complete descriptor composition and admission. Next action: bind actual native
+publisher/authenticator, original/current session verification and revocation,
+executable storage/custody and config pins, then obtain the six missing fixed
+owner descriptors/adapters for ensure-groups, mint-secret, deliver-secret,
+bind-env, deliver-consumer-secret and hand-over. The inventory identifies each
+existing owner seam, exact missing contract and created-only rollback requirement;
+it is not an executable bundle. T14 and T15 remain independent prerequisites.
+
+Review the dedicated consumer source1.2 composition only through the existing
+explicit version-root selection. Keep canonical1.1/default and its accepted case
+unchanged, and the source-only acknowledged1.2 reference case proposed without
+acceptance fields. New descriptor bytes require a reviewed exact successor
+revision/version under canon section6; they do not inherit historical source
+acknowledgment. Changed authentication/materialization/trust needs the prescribed
+informed-decision acknowledgment. Do not insert a partial descriptor map or use
+--allow-unimplemented preparation as ordinary case/native admission. The registry
+helper reports restart_required; separately review quiet-window restart/readiness
+and actual consumer verification rather than infer activation from registry CAS.
+Exact composition: Custodian native-registration-r1/descriptor-composition.json.
 Completion requires separate owner source review of exact machine descriptors,
 artifact/source/config pins, normal type/version admission and independent
 evidence-verification boundaries. Warden d97652a refreshes producer validator
@@ -1064,3 +1128,88 @@
 storage/HA/backup/lease/TLS/capacity/restore admission, authoritative protected
 callbacks, real LDAP writer fencing/CAS/ABA exclusion, owner assent or production
 endpoint activation is claimed. Those remain live T14 work.
+
+
+## T22 — Establish registration recovery source gaps and complete descriptor review inventory
+
+```task
+id: NK-WP-0048-T22
+status: done
+priority: high
+```
+
+Completed 2026-10-17: source-only owner-contract review and complete review
+inventory. Inspected the actual registration adapter, Warden Journal/Executor,
+NetKingdom evidence compatibility checker and Audit Core custody/read surfaces.
+No existing admitted holder/readback supplies authenticated original-attempt
+recovery: payload/creation are process-local, persisted evidence references are
+hashed, and reconcile receives a new attempt without original context. The exact
+four-owner contract requirements and non-replayable missing/ambiguous cases are
+recorded; no recovery callback, publisher, credential grant or native trust root
+was installed. T15 retains implementation and actual acceptance.
+
+The complete source1.2 inventory maps all seven follow-through steps to their
+existing owners, missing exact contracts and created-only rollback requirements.
+The actual maintained adapter regenerated the sole existing register-client
+machine descriptor against the delivered 13,633,409-byte checker and current
+sealed-memfd snapshot source. The checker rehash and Warden Descriptor.decode
+round-trip passed; six owner descriptors remain absent. Actual source commands
+render canonical1.1 and explicitly selected1.2 with execution.permitted false;
+ordinary1.2 case admission still refuses its acknowledged/unimplemented type.
+Canonical type/case/acknowledgment bytes were hash-checked unchanged. No tests were
+added or rerun, no native configuration or effect occurred, and no owner assent
+or complete machine bundle is claimed. T16 retains native executable custody,
+complete exact descriptors, independent source review and normal version/type
+admission. This extracted outcome supplies no native gate completion credit.
+
+Evidence in the-custodian:
+`docs/changes/netkingdom-target-2026-10-17/native-registration-r1/`, especially
+original-attempt-review.json, descriptor-composition.json, source-verification.json,
+source-manifest.json and manifest.json. The prior sixteen-gate audit remains
+immutable. Publication, normal task UUID allocation and projection are separate
+coordinator follow-through; no Hub UUID is assigned by this source record.
+
+
+## T23 — Review native journal package assignment and storage integration boundaries
+
+```task
+id: NK-WP-0048-T23
+status: done
+priority: high
+```
+
+Completed 2026-10-17: source/package placement and protected integration review
+only, separate from T21's completed PostgreSQL source and disposable-SQL proof.
+The owner review recommends a dedicated independently rolled-back
+`rapp-identity-provisioner`, owned by NetKingdom on rail-kubernetes, with a
+schema-valid draft declaration and no reef binding. No repository, registry
+entry, native package assignment or owner assent was created. Existing
+rapp-user-engine ownership/token delivery does not assign it the provisioner.
+
+The complete current rapp-postgres catalog has six declared consumers: four on
+platform-pg and two on platform-pg-2. The inert renderer-valid provisioner
+candidate fits platform-pg-2 at three of four, requesting one migration plus
+four runtime connections; placing it on the first cell is refused as a fifth.
+Normative package schema and full-catalog capacity/render checks passed. The
+four-consumer ceiling is estimated, not measured native headroom, and no current
+SQL session, backup or restore acceptance is claimed.
+
+The exact review identifies remaining package/substrate, SQL role/lease/TLS,
+network and backup/recovery contracts; independently authenticated protected
+scope callbacks; an external content-bound checkpoint holder with atomic
+advance/loss handling; and all-LDAP-writer exclusion or provider CAS/generation,
+including lifecycle cascades and remove/readd ABA. Generic Audit custody is not
+that checkpoint service. A database-only fence, final reread or one replica
+cannot exclude foreign directory writers. The native acceptance/recovery matrix
+keeps storage/lease admission separate from separately approved directory
+mutation; the production activation remains disabled pending trusted integration.
+
+Evidence in the-custodian:
+`docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md`,
+source-validation.json and hash-bound source-references.json, plus the inert
+proposed declaration/consumer and renderer outputs. No native resource, lease,
+credential, deployment, destructive effect, independent holder or native owner
+acceptance was delivered. T14 retains these live gates with its original UUID
+and progress status. This completed review adds no duplicate T21 acceptance
+credit; publication, task UUID allocation and projection remain coordinator
+follow-through and no UUID is hand-assigned here.