diff --git a/clusters/base/platform.yaml b/clusters/base/platform.yaml
index 394f0cd..f921649 100644
--- a/clusters/base/platform.yaml
+++ b/clusters/base/platform.yaml
@@ -11,27 +11,18 @@ spec:
   interval: 10m
   retryInterval: 2m
   timeout: 5m
-  # ======================= TEMPORARY — prune:false TRANSITION STATE =======================
-  # RESTORE TO `prune: true` IN THE VERY NEXT MERGE. This is step 1 of the documented Flux
-  # procedure for MOVING RESOURCES BETWEEN KUSTOMIZATIONS (fluxcd.io/flux/faq: "set spec.prune to
-  # false, sync, move the manifests, then re-enable pruning"), used here to move ./platform/cilium
-  # out of this tier and into its own `cilium` Kustomization (clusters/base/cilium.yaml).
+  # Cilium was moved OUT of this tier into its own Kustomization (clusters/base/cilium.yaml)
+  # on 2026-09-01. `prune: true` is restored here now that the ownership transfer is VERIFIED
+  # live: Namespace/kube-system, the Cilium HelmRelease and the HelmRepository all carry
+  # `kustomize.toolkit.fluxcd.io/name=cilium`, this Kustomization's inventory no longer lists
+  # any of the three, and the `cilium` Kustomization's inventory holds exactly those three.
   #
-  # WHY IT IS NOT OPTIONAL: `platform/cilium/namespace.yaml` is the ONLY declaration of
-  # Namespace/kube-system anywhere under ./platform, and the live object carries
-  # `kustomize.toolkit.fluxcd.io/name=platform`. The moment ./platform/cilium leaves this
-  # Kustomization's rendered path, Namespace/kube-system + the Cilium HelmRepository/HelmRelease
-  # become STALE in this Kustomization's inventory. With prune:true that is not "uninstall the
-  # CNI" — it is `kubectl delete namespace kube-system`, which takes the whole cluster.
-  #
-  # A SECOND, INDEPENDENT PROTECTION IS ALSO IN PLACE (belt and braces, deliberately):
-  # kustomize-controller's pruner passes `Inclusions: GetOwnerLabels(platform, flux-system)`, so it
-  # only deletes objects whose LIVE labels still say they belong to `platform`. The new `cilium`
-  # Kustomization relabels all three objects to `name=cilium` when it applies them, and the
-  # `dependsOn: [cilium]` edge below is REVISION-gated — `platform` cannot reconcile revision N
-  # until `cilium` has APPLIED revision N. So the relabel provably precedes the prune. Neither
-  # mechanism is trusted alone for an object of this blast radius.
-  prune: false         # <-- TEMPORARY; see block above. Normal value: true (R-GITOPS-03)
+  # LESSON WORTH KEEPING: `platform/cilium/namespace.yaml` was the ONLY declaration of
+  # Namespace/kube-system under ./platform. Moving that path out of a prune:true Kustomization
+  # made the stale set `delete namespace kube-system` — coredns, metrics-server, local-path AND
+  # Cilium. Before moving ANY platform/* component in future, check whether it is the sole
+  # declarer of a shared Namespace; that turns a component-scoped prune into a cluster-scoped one.
+  prune: true
   wait: true           # block `apps` until platform is healthy
   # ORDERING FIX (2026-09-01 incident: a substitution race that failed OPEN broke Cilium).
   #