Expire WH-ENG-20260822-AUDIT-E2-01 after an unused window

The 18:00Z-18:15Z window ended with no projection-ready notice and zero
packets. Mark the identifier terminal. Record platform-pg E3 as not
applicable for an ordinary runtime conformance-view identity.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

src/whitehat_security/engagement.py

@@ -39,6 +39,10 @@ class Engagement:
     def validate(self, *, now: datetime | None = None) -> None:
         if self.raw.get("status") == "cancelled":
             raise AuthorizationError("engagement is cancelled")
+        if self.raw.get("status") == "expired":
+            raise AuthorizationError(
+                "engagement window elapsed with no live run; identifier must not be reused"
+            )
         if self.raw.get("status") == "proposed":
             raise AuthorizationError(
                 "engagement is proposed; operator approval and owner acknowledgement are pending"

src/whitehat_security/plane.py

@@ -15,6 +15,7 @@ STANDING_E2_TTL = 900
 TERMINAL_IDS = frozenset({
     "WH-ENG-20260821-AUDIT-E2",
     "WH-ENG-20260821-TENANT-E2",
+    "WH-ENG-20260822-AUDIT-E2-01",
 })
 APPROVAL_CLASSES = {
     "fixture-e2": frozenset({"e2-differential"}),
@@ -41,7 +42,7 @@ def retired_ids(engagements_dir: str | Path | None = None) -> set[str]:
             data = json.loads(path.read_text(encoding="utf-8"))
         except (OSError, json.JSONDecodeError, ValueError):
             continue
-        if data.get("status") == "cancelled" and data.get("engagement_id"):
+        if data.get("status") in {"cancelled", "expired"} and data.get("engagement_id"):
             retired.add(data["engagement_id"])
     return retired