Close Core Hub operator UI gate

docs/core-hub-replacement-evidence.md

@@ -27,6 +27,10 @@ old Inter-Hub-first ops-hub path:
 - `CORE-WP-0008-T05`: `make operator-cli` wraps the same API behavior for
   deployed smoke, ops-hub bootstrap status, migration validate/import, and
   cutover readiness summaries.
+- `CORE-WP-0006`: protected `/console` prototype exists with readiness,
+  registry, migration/cutover, action-required, access metadata, and evidence
+  stream sections. `make visual-check` passed on 2026-06-27 with desktop/mobile,
+  no-overlap, horizontal-overflow, protected-route, PNG, and non-secret checks.
 - `CORE-WP-0008-T06`: the web UI is gated behind API/CLI readiness and has a
   compact whynot-aligned first-screen backlog. The UI should not start by
   recreating every old Inter-Hub screen.
@@ -92,6 +96,11 @@ wrong-audience rejection, and production rejection of local-development issuers.
 This closes the identity integration template while leaving production issuer
 wiring for the deployed Core Hub gates.
 
+2026-06-27 T18 closeout: Core Hub `CORE-WP-0006` is finished and local
+`make visual-check` passed for `/console`. The first UI surface is intentionally
+compact and protected; broader UI implementation remains gated by deployed API
+and CLI evidence through the rebuild backlog.
+
 ## Remaining Gates
 
 - Run `make deployed-smoke` or `make operator-cli CLI_ARGS="deployed-smoke ..."`

docs/infrastructure-stabilization-pickup-checkpoint.md

@@ -104,14 +104,14 @@ Resume from `docs/daily-triage-stabilization-status.md` and
 | issue-core | ArgoCD service is healthy on port `8765`; image `0.2.1`; ExternalSecret Ready; authenticated smoke created Gitea issue `175`. | activity-core still needs `ISSUE_CORE_API_KEY`, URL port `8765`, `ISSUE_SINK_TYPE=rest`, and a safe emission smoke. |
 | Forgejo | Migration inventory/design lane is active but pre-cutover. | Production design decisions, SMTP/email recovery, package registry, Actions, backup/restore, migration drill, cutover approval. |
 | artifact-store | D7.1 is done; D7.2 has an opt-in live MinIO compatibility harness and manual smoke docs. No live secret handoff is recorded. | Run D7.2 against an approved MinIO-compatible endpoint, then route D7.3 STS vending through identity/platform custody before changing credential behavior. |
-| FOS hub | Old NK-WP-0001 Keycloak prerequisite is cancelled; NK-WP-0002 local identity, IAM Profile v0.2, and the Core Hub FastAPI IAM Profile integration test are done; hub-core extraction/dev-hub work is done; CUST-WP-0025 Phase 3 has been rewritten for Core Hub. | Execute the rewritten Core Hub deployed smoke/cutover and UI first-screen gates: `CUST-WP-0025-T16`, `T17`, and `T18`. |
+| FOS hub | Old NK-WP-0001 Keycloak prerequisite is cancelled; NK-WP-0002 local identity, IAM Profile v0.2, the Core Hub FastAPI IAM Profile integration test, and Core Hub operator UI first screens are done; hub-core extraction/dev-hub work is done; CUST-WP-0025 Phase 3 has been rewritten for Core Hub. | Execute the remaining Core Hub deployed evidence and cutover gates: `CUST-WP-0025-T16` and `T17`. |
 
 ## Next-Pick List
 
 1. Execute the remaining rewritten `CUST-WP-0025` Core Hub gates: deployed
-   smoke and activity-core proof (`T16`), cutover decision coupling (`T17`),
-   and first UI screens (`T18`). T03 and T14 are complete as the identity
-   integration template and ops evidence/read-model contract gates.
+   smoke and activity-core proof (`T16`) and cutover decision coupling (`T17`).
+   T03, T14, and T18 are complete as the identity integration template, ops
+   evidence/read-model contract, and operator UI first-screen gates.
 2. Keep `CUST-WP-0047` and `CUST-WP-0049` as legacy evidence/fallback until
    Core Hub deployed smoke evidence or an explicit supersede decision closes
    them.