fix(ci): retain reliable audits and owned native fixture evidence (#35)

* test(kernel): avoid repeated CI census and database setup

Retain every production subject and mutation while indexing actual
instruction populations within each detector evaluation. Plain database
fixture setup owns a physical nonpooled connection instead of repeating
Docker and psql startup; real role, rollback and cleanup controls pin the
same authority. Record completed local proof without implying hosted fit.

ADR: 0003, 0047, 0060

* test(ci): observe native prerequisites and completed cases

Measure the unchanged proof workload before selecting collector authority
or scheduling bounds. Report only finite read-only environment facts and
enable the stock console logger alongside final TRX results. Preserve all
filters, required names and deadlines; the native preflight still refuses
unsupported collectors. Keep the decision index tied to local closeout.

ADR: 0060

* fix(web): classify read-only CI diagnostic sources

Keep the repository source census fail-closed while recording the two\nCI-only Python observer files with the existing non-runtime tooling.

* docs(decisions): revise native CI authority and qualification

Separate the proposed native VM and fixed collector lifecycle from
measured CI outcomes, preserve complete required coverage, and record
reviewed alternatives without accepting or implementing the decision.

ADR: 0060

* test(kernel): defer capacity and recipient owner formatting

Keep the complete production and mutation census while avoiding eager
identity formatting for unrelated calls and field writes. Preserve
independent raw traversal parity and per-evaluation cache lifetimes.

ADR: 0047

* test(kernel): index concrete task owner writes

Keep the same concrete task-owner proof while selecting field writes
from the current detector index, so unrelated method identities are
not rebuilt on every mutation. Record full and focused qualification
without treating local timings as hosted CI success.

ADR: 0047

* docs(decisions): accept bounded native CI provisioning

Record the maintainer's approval before dependent CI implementation.
Preserve ADR-0060's accepted body through a dated bounded disclosure
and keep implementation, enforcement and hosted qualification pending.

ADR: 0060, 0062

* ci: isolate and qualify complete native crash proofs

* fix(ci): preserve exact interrupted test evidence

* fix(ci): align native proof context and compiler census

Accept the hosted runner's documented absent-services representation and
parse native ownership with the actual Release build symbols so normal
jobs launch and conditional native calls cannot escape their partition.
Record both independent review rounds and real native protocol evidence.

ADR: 0062

* fix(ci): publish synthetic cgroup snapshots atomically

Keep the strict production event parser while preventing a forked test
fixture from exposing an empty intermediate file on faster Linux hosts.
Record the real hosted failure separately from local repair evidence.

ADR: 0062

* fix(ci): retain closed crash inventory refusal details

Keep every crash candidate fatal to qualification while retaining enough
finite metadata to distinguish its scan scope and filename category.
Never export candidate paths, contents or provider text from the VM.

ADR: 0062

* docs(decisions): propose complete bounded CI test shards

Reopen the execution topology after measured hosted budget failures while
preserving every case, existing required names and twenty-minute ceilings.
Record reviewed finite VM costs and defer dependent code to acceptance.

ADR: 0062, 0063

* fix(ci): classify crash candidates without disclosing contents

Keep unknown inventory candidates fatal while observing a finite format
label through one fixed read-only probe within the existing scan budget.
Diagnostic faults never replace the original qualification refusal.

ADR: 0062

* fix(ci): distinguish bounded Docker inventory observations

Keep scan decisions strict while distinguishing fixed storage regions,
common file formats and a refused probe without exporting private data.
Record actual prelaunch observations separately from qualification.

ADR: 0062

* fix(ci): retain closed image and workload failure facts

* fix(ci): qualify image layer scope in crash inventory

* fix(ci): classify unexpected workload faults without provider text

* fix(ci): retain result evidence across diagnostic rotation

* docs(roadmap): record native proof and rotation review

* docs(decisions): revise bounded CI shard qualification

Separate retained wall evidence from incomplete duration estimates and
make manual tuning, independent layouts, runner authority and aggregate
ownership concrete before seeking acceptance. Preserve the outstanding
ordinary owner fault and all hosted qualification gates.

ADR: 0062, 0063

* docs(roadmap): record revised shard proposal reviews

Keep independent proposal reviews and document checks distinct from
maintainer acceptance and final hosted qualification.

ADR: 0063

* docs(decisions): accept complete bounded CI shard plan

Record maintainer approval before dependent implementation, disclose
ADR-0062's bounded replacement and additive authority, and register the
general CI obligation without claiming implementation or hosted fit.

ADR: 0062, 0063

* feat(ci): add complete selector assignment and bounded shard plan

Keep every fresh discovered test in one deterministic owner and prove
both accepted layouts against exact per-project selector discovery.
Retain timing provenance without letting estimates define membership.
Fix a nonserializable theory and bind TRX Unicode equivalence to the
actual discovered assembly and case identity.

ADR: 0062, 0063

* fix(ci): refuse selectors shared across trait partitions

Reject cross-partition selector groups before assignment so theory
and overload rows cannot acquire multiple execution owners despite
complete case-ID unions. Cover every partition boundary in both
layouts and record independent first-round verification.

ADR: 0063

* docs(roadmap): close selector plan reviews and begin execution

Record both fresh independent Step 1 reviews and the committed
cross-partition correction. Keep hosted fit and the remaining
execution and aggregate obligations explicit.

ADR: 0063

* feat(ci): add bounded shard execution and scoped resource receipts

Extend the existing owned process lifecycle with complete selector
rediscovery and exact shard result reconciliation. Confine non-Docker
jobs to their process subtree, preserve native-only collector setup,
and record actual toolchain, phase and resource observations.

Handle only verified proc task-exit races narrowly and retain closed
stage diagnostics for other membership failures. Keep hosted fit and
workflow attestation pending the final implementation step.

ADR: 0062, 0063

* docs(roadmap): record bounded execution first review

Record independent approval and exact local control results without
claiming Linux containment or final-source hosted qualification.

ADR: 0062, 0063

* fix(ci): bound startup and surface pre-ready worker refusals

Observe failed units while waiting for readiness instead of spending
the full execution allocation. Retain a bounded closed startup cause
and a thirty-second handshake cap within the existing job budget.
Prove no workload starts and owned cleanup still runs after refusal.

ADR: 0062, 0063

* docs(roadmap): close bounded execution reviews and correction

Record both independent Step 2 reviews and the verified startup fix
before beginning workflow and aggregate enforcement.

ADR: 0062, 0063

* feat(ci): enforce complete attempt-bound shard results

Keep every discovered case and mandatory build gate behind the existing
required results while bounding each execution and aggregate. Verify
current-attempt job outcomes and immutable archive identities before
recomputing exact result unions; retire unsharded execution paths.

ADR: 0062, 0063

* fix(ci): join aggregate manifests and preserve rerun identity

Bind both required results to the same current-attempt immutable base
witness so contradictory trait partitions cannot omit cases. Treat
GitHub's run head as the event snapshot rather than its mutable PR
projection, and classify only the five new CI paths as non-runtime.

ADR: 0062, 0063

* fix(ci): retain image identity and deterministic interruption proof

Keep the validated weekly image release in each producer receipt and
remove a child-start race from the interruption proof. Adapt the
read-only observation control to the approved aggregate topology while
preserving native-only observation and all production time budgets.

ADR: 0062, 0063

* fix(ci): retain closed failure locations for hosted diagnosis

Keep only finite facade source codes and bounded line numbers for
validated failed cases, without exporting raw stacks or weakening
completion evidence. Record completed source reviews and the remaining
hosted failures separately from local passing controls.

ADR: 0062, 0063

* docs(roadmap): record hosted diagnostic correction approval

Keep the independently verified diagnostic and completed source reviews
separate from the remaining real Linux failures and final A/B proof.

ADR: 0062, 0063

* fix(ci): expose finite heartbeat and public proof failure facts

Locate repeated hosted failures through existing test-owned closed
stages and bounded timing/pool facts while keeping raw diagnostics
private. Preserve every test, ownership rule and execution budget.

ADR: 0062, 0063

* fix(ci): match actual generation record diagnostic shape

Use the real compiled record output rather than an internal property
that generated ToString omits. Keep unexpected record members unknown
and preserve closed failure-only observation.

ADR: 0062, 0063

* docs(roadmap): record reviewed finite hosted failure diagnosis

Record the actual-record correction and fresh second approval alongside
complete predecessor results. Keep both failing cases and final-source
A/B qualification open rather than treating diagnostics as a fix.

ADR: 0062, 0063

* fix(jobs): observe native heartbeat lifecycle progress

The hosted pause proof cannot distinguish an unentered heartbeat from a
provider call or cleanup that has not returned. Retain bounded in-memory
phase and count observations without granting them lifecycle authority,
and export only closed failure facts through the existing CI diagnostic.
Include the verified capacity-control source in the same finite map.

ADR: 0047, 0059, 0063

* docs(roadmap): record heartbeat diagnostic reviews

Keep both independent approvals and their actual control evidence distinct
from the still-unresolved hosted failures and final-source qualification.

ADR: 0063

* fix(kernel): qualify native starts after committed handoff

Keep execution-focused fixtures independent of the bridge repair grace
when a native hint skips the ACK row lock. Preserve body failures during
explicit cleanup and observe physical opening separately so hosted
failures retain their original bounded diagnostics.

ADR: 0047, 0059, 0063

* test(kernel): qualify adjacent native execution premises

Apply the verified handoff prerequisite to execution-only capacity and
cleanup scenarios so their waits cannot accidentally test the separate
repair grace. Preserve the original assertions, bounds and bridge tests.

ADR: 0047, 0063

* docs(roadmap): record native correction review approvals

Record both independent rounds for the native diagnostic and adjacent
execution qualification corrections without attributing historical
hosted failures or closing the final-source A/B gate.

ADR: 0063

* fix(kernel): join asynchronous vendor connection acquisition

Use the guarded driver's asynchronous DNS and socket path behind the
stock synchronous factory. This avoids its verified positive-fraction
socket timeout truncation without abandoning actual acquisition or
weakening the physical role guard. Keep initializer awaits context-free
and prove path selection, actual completion and role refusal in Postgres.

ADR: 0047, 0058, 0059, 0063

* fix(kernel): share bounded privileged connection acquisition

Cover bootstrap's remaining synchronous acquisition at the same guarded
source entry as the vendor factory. Preserve authority before lazy source
resolution and join the real asynchronous acquisition without duplicating
adapter logic. Exercise both callers with the held initializer and prove
the old common driver call fails both planted controls.

ADR: 0047, 0058, 0059, 0063

* docs(roadmap): record acquisition correction reviews

Record both independent correction reviews and keep source-specific failed
receipts distinct from live final-source qualification. Point the primary
status carriers at the open PR for subsequent immutable A/B evidence so a
historical failed run does not become the current source's status.

ADR: 0063

* test(kernel): qualify remaining native execution entry premises

Execution and cleanup subjects must not depend on an initial stock hint
acquiring an ACK-locked row before the accepted repair grace expires.
Qualify actual entry or committed handoff with one route-correct stock hint,
while preserving natural bridge, fairness and no-admission proofs.

ADR: 0047, 0059, 0063

* docs(roadmap): record native entry correction reviews

Retain both independent approvals and source-specific validation before
final hosted qualification resumes on the reviewed execution fixtures.

ADR: 0063

* test(kernel): join actual pool and native wrapper completion

Observe the owned application pool rather than immediate database-wide
session counts, and join every qualification hint before exact native
work snapshots. Preserve held callbacks and reject omitted factory cleanup.

ADR: 0047, 0059, 0063

* docs(roadmap): record owned completion correction reviews

Retain both independent reviews and actual restoration controls before
resuming final-source hosted qualification.

ADR: 0063

* fix(kernel): close verified job runtime review gaps

Expose unresolved capacity recovery without releasing its reservations,
exercise the production admission owner in checkpoint proofs, and anchor
published distribution checks to the reviewed checkout. Preserve fork CI
identity and closed refusal diagnostics; reconcile live job documentation.

ADR: 0047, 0058, 0063

* docs(standards): finish job authority reconciliation

Remove remaining live payload and activator authority descriptions found
by the first independent correction review. Record both reviews and their
verification without changing accepted decisions or historical evidence.

ADR: 0047, 0063

* docs(roadmap): record completed correction reviews

* test(kernel): preserve observation hash projection controls

* docs(roadmap): record projection correction reviews

* test(kernel): isolate final fence from retry hint diagnostics

* test(kernel): order native staging after bridge acknowledgement

* docs(roadmap): close native fence correction reviews

* fix(kernel): tighten verified review safeguards

Pin CI dependencies and refuse incomplete lifecycle comparisons while
preserving exact artifact identity. Add independent worker/event boundary
proofs, preserve explicit retry hints and reconcile source-specific
evidence and current documentation. Keep quota accounting a proposal
until its commercial meaning is selected.

ADR: 0047, 0057, 0063

* docs(standards): clarify retry hint default after review

Align the live error-handling contract with explicit retry hint
preservation and record the independent correction review.

* docs(roadmap): record completed safeguard correction reviews

Record both independent rounds, their verified correction and validation
limits. Keep dependency update automation outside this minimal fix; exact
CI dependency pins remain enforced. Quota accounting still requires the
maintainer's commercial choice.

* docs(architecture): accept content type quota accounting

Record the maintainer's explicit choice before implementing the shared
registration guard. Count distinct nondeleted custom keys, share revision
slots, exclude the built-in card and serialize tenant-wide admission.

ADR: 0021

* fix(customization): enforce approved content type quota

Serialize tenant-wide count and registration before the existing concept
lock. Apply the approved distinct-key accounting without changing default
unlimited entitlements or lifecycle authority. Keep hard-limit refusals
consistent across HTTP, audit and job classification.

Register both CI Python tools in the exact source inventory; unknown
formats still fail closed. Retain the failed CI and planted-lock evidence.

ADR: 0021, 0040, 0045
Module: Customization
I18n: lockey_limit_exceeded

* docs(roadmap): record first quota correction review

Record independent contract and PostgreSQL inspection and distinguish
current Debug review runs from rebuilt full Release evidence. Link the
hard-limit error mapping to its existing entitlement decisions.

* docs(roadmap): close quota correction reviews for qualification

Record both fresh quota reviews, current Release and PostgreSQL proofs,
and the complete frontend source inventory correction. Freeze the source
for renewed exact-head CI; historical results remain source-specific.

* docs(roadmap): close merged P02b-4 and name the next packet

Record the identical squash-merge tree and complete final-source A/B
qualification. Reconcile mutable status carriers while preserving dated
delivery receipts and keeping P02b-5 authentication gates open.

ADR: 0047, 0063

* docs(decisions): propose the P02b-5 authentication boundary

Verify the authentication entry contract before exposing validated claims
while authorization remains staged. Record the bounded audit and read-mode
instruments, shared ingress costs and five reviewable development steps
for maintainer approval before runtime changes.

ADR: 0064, 0036, 0040

* docs(roadmap): record P02b-5 decision reviews

Keep the reviewed proposal and current entry evidence separate from runtime
delivery. Close both independent decision review rounds, reconcile mutable
phase pointers and retain the explicit maintainer acceptance boundary.

ADR: 0064, 0036, 0040

* docs(decisions): resolve tenant authentication review gaps

Make absent-credential masking, host-backed read admission and rejection
attribution explicit before activation. Close JOSE and vendor diagnostic
boundaries, disclose the full read-mode scope extension and preserve prior
review receipts with dated finding dispositions rather than rewriting them.

ADR: 0064, 0036, 0040, 0052

* docs(roadmap): record first authentication revision reviews

Retain independent review evidence without treating it as acceptance.
Make real-identifier checks explicit at the host-backed read boundary so
an initialized wrapper cannot be mistaken for a valid tenant identity.

ADR: 0064, 0036, 0040, 0052

* docs(roadmap): close authentication proposal revision reviews

Record the second independent revision round and final document checks
without treating reviewer approval as maintainer acceptance. Keep the
original receipts and runtime boundary explicit before renewed approval.

ADR: 0064, 0036, 0040, 0052

* docs(decisions): accept the tenant authentication boundary

Record explicit maintainer acceptance before dependent runtime work.
Disclose the bounded audit and exact read-mode changes in each affected
ADR, correct row-10 staging through adjacent errata, and register the
five proof obligations without claiming implementation evidence.

ADR: 0064, 0036, 0040, 0052

* feat(kernel): add the isolated tenant token foundation

Validate signed tenant credentials against the accepted closed profile and
bound metadata retrieval before activating the HTTP authentication surface.
Keep raw vendor failures out of enabled sinks while preserving closed
application outcomes and unrelated diagnostics.

ADR: 0064, 0036, 0032

* fix(kernel): keep metadata hosts out of native HTTP metrics

Constrain native HTTP and DNS metric dimensions because request-local
trace suppression does not prevent destination names reaching OTLP.
Preserve duration and status signals, and prove the boundary with real
retrieval, an unprojected control and a distinct hostname canary.

ADR: 0064, 0032

* docs(roadmap): close both token foundation review rounds

Record independent validation of the native metric privacy correction and
keep the primary status carriers aligned before starting the real
read-only application subject.

ADR: 0064

* feat(tenancy): add the host-bounded read-only account query

Expose only the caller's validated scope and the existing public site
projection through an independently guarded application request. Select
its physical read-only mode by one immutable exact-type declaration and
share the existing transaction owner across API and Seeder composition.

Prove actual app-role isolation, lifecycle visibility, audit Off behavior
and SQL/EF write refusal before routing the request over HTTP.

ADR: 0064, 0040, 0052, 0036

* docs(tenancy): record account query review and implementation

Record both independent Step 2 first-round checks and reconcile the
read-only standard with the implemented query before HTTP activation.

ADR: 0064, 0040, 0052

* docs(roadmap): close both account query review rounds

Record independent transaction, isolation and composition verification before
starting attributed reconciliation and subject admission.

ADR: 0064

* feat(kernel): attribute tenant refusals and add subject admission

Carry validated identity through reconciliation without inventing audit
tenants, and bound authenticated rejection work before recording. Preserve
anonymous admission and keep production HTTP activation in the next step.

ADR: 0064, 0036, 0033, 0044

* docs(roadmap): record the first admission review round

Record independent checks of quota lifetime, attributed refusal and actual
app-role audit behavior before the second review round.

ADR: 0064

* fix(kernel): export actor UUIDs at rejection log boundaries

Apply the identifier emission rule to both rejection log paths and pin the
actual subject quota window independently. Close both Step 3 reviews with
verified corrections and a planted default-window control.

ADR: 0064, 0023

* docs(roadmap): wrap the admission closeout pointer

Keep the current packet summary within the documentation prose convention.

ADR: 0064

* feat(api): activate the closed tenant authentication boundary

Bind strict bearer validation, host reconciliation and subject admission to
one independently guarded read. Keep anonymous transport credential-free and
qualify production routing, durable rejection attribution and generated
public/authenticated contracts before widening the HTTP surface.

ADR: 0064, 0036, 0040, 0052
Module: Tenancy

* fix(api): document the early request body refusal

The actual HTTP boundary rejects oversized GET bodies before authentication,
but generated clients could not see that response. Require 413 in the served
contract and negative controls while preserving the existing runtime outcome.

ADR: 0064

* docs(roadmap): close both HTTP activation review rounds

Record independent rechecks of the complete active boundary and its corrected
contract before progressing to final production enforcement and qualification.

ADR: 0064

* test(kernel): enforce closed tenant authentication authority

Keep the activated authentication boundary dependent on its typed,
validated identity and explicit production consumers. Prove missing,
forged and mutable subjects fail the same complete census. Reconcile
carrier contracts and catalogue owners without claiming pending CI.

Make terminal-plan seed maintenance explicit so bitmap EXPLAIN counts
measure live backlog rather than obsolete MVCC index entries.

ADR: 0064

* fix(kernel): close alternate authentication authority paths

Reject role metadata through its interface and positional identity
extraction through generated deconstruction. Compiled negative controls
reproduce each review gap before the detector correction.

Reconcile the older job manifest's exact controller inventory with the
approved AccountSite read and exercise its extra-action refusal. Align
catalogue derivations and startup guidance with the active boundary.

ADR: 0064

* fix(kernel): close identity exports and inherited role metadata

Keep record formatting and alternate token APIs from bypassing the typed
identity census. Bound acquisition and forwarding to the actual owners,
and resolve authorization metadata through inheritance and interfaces.

Compiled negative controls reproduce all three review gaps before the
corrections; independent original probes confirm closure. Reconcile the
remaining scalar-scope and membership reachability documentation.

ADR: 0064

* docs(roadmap): close tenant API implementation and reviews

Record all five completed steps, both independent review rounds and
verified corrections while separating failed/as-of receipts from final
PR-head qualification. Keep realm issuance, browser sessions and phase
exit with their first consumers; start no next packet.

ADR: 0064

* docs(roadmap): link tenant authentication review handoff

Keep the live PR-head CI receipt discoverable from the local delivery
record without treating an unmerged implementation as a merged packet.

ADR: 0064

* docs(decisions): fix punctuation in ADR index summaries

* docs(decisions): accept bounded tenant assertion diagnostics

Accept the reviewed target-tenant audit allowance before dependent code.
Disclose the loss of durable actor coverage and outbound destination
metrics, preserve older decisions, and reconcile the proof owners.

ADR: 0036, 0064, 0065

* fix(kernel): close tenant authentication review gaps

Bind authentication and host authority to validated inputs, enforce the
reviewed audit allowance, and strengthen the production censuses with
load-bearing controls. Keep public transport and API configuration
confined and reconcile the served OpenAPI and generated SDK contracts.

ADR: 0036, 0040, 0052, 0064, 0065
Module: Tenancy, Kernel

* docs(roadmap): record authentication review corrections

Record verified dispositions, completed local populations and fresh
independent reviews. Reconcile the shipped allowance and signal owners
without borrowing historical CI receipts for the correction head.

ADR: 0064, 0065

* fix(ci): retain closed public demo failure phases

Preserve the first browser or worker phase across owned cleanup without
exporting provider text. Exercise real worker connection refusal and
primary/cleanup failures without changing proof budgets or retries.

ADR: 0056, 0064

* fix(ci): recognize signalled browser startup exits

Read Node's signal status alongside numeric exit status so a terminated
browser is diagnosed without waiting for the startup deadline. Cover live,
normal and signal status using actual child processes.

ADR: 0056, 0064

* fix(ci): accept native child status in diagnostic types

Describe only the process fields read by closed diagnostics. Compile-check
real ChildProcess values and the operation callback in existing native
child controls, while retaining unknown-field sanitization coverage.

ADR: 0056, 0064

* docs(roadmap): record hosted authentication qualification

Record complete source-bound backend receipts and the isolated demo
refusal, with closed-diagnostic corrections and both fresh review rounds.
Keep final-source hosted qualification explicit and mandatory.

ADR: 0064, 0065

* docs(standards): Mark ADR-0065 diagnostic controls as implemented

* fix(auth): close review privacy and proof gaps

Enforce exemplar privacy, exact issuer/JWKS paths and worker process
attribution. Strengthen production censuses, real persistence and HTTP
controls, and SDK ownership proofs. Reconcile historical evidence and
production activation ownership. ADR-0066 remains Proposed; subject-cap
policy refinements await explicit approval.

ADR: 0064, 0065

* fix(tests): close cross-assembly and middleware proof gaps

Scan counter and header literals across all production assemblies.
Inspect source-owned middleware and OpenAPI helper leaves before treating
framework calls as terminals; plant real-wrapper and alias mutations.
Record first-round findings, completed controls and exemplar correlation
cost without claiming current-head hosted qualification.

ADR: 0064, 0065

* fix(tests): reject hidden fluent middleware registrations

Trace builder-valued receivers conservatively before skipping ordinary
calls. Actual Program and resolver return mutations must expose chained
extra authentication with a specific diagnostic; endpoint naming remains
clean. Record round-two findings and the separate schema-proof limit.

ADR: 0064

* docs(roadmap): record verified second review corrections

Record both independent rounds, verified proof fixes and targeted recheck.
Keep hosted qualification source-bound and ADR-0066 approval outstanding.

ADR: 0064, 0065

* docs(decisions): clarify subject admission fault ownership

Separate sticky cleanup failure from ordinary quota and capacity pressure.
Specify one-disposal acquisition ordering, shared retirement ownership and
unbounded disposal latency without claiming dependent runtime delivery.

Mark mutable cap carriers as current code under a Proposed decision and
name exact HTTP, metric, cleanup and concurrency proof obligations.

ADR: 0066

* docs(decisions): complete admission retry contract inventory

Record the first independent review round and explicitly include capacity
retry-hint semantics in the future served and snapshot OpenAPI changes.
Keep ADR-0066 Proposed and implementation proofs pending approval.

ADR: 0066

* docs(roadmap): record subject admission revision reviews

Record both fresh independent review rounds, the verified retry-contract
inventory fix and current documentation/corpus validation. ADR-0066 stays
Proposed and dependent runtime work still requires maintainer approval.

ADR: 0066

* docs(decisions): accept bounded subject admission contract

Record maintainer approval before dependent runtime changes. Preserve the
Accepted ADR-0064/0065 bodies with adjacent attribution errata and their
own dated disclosures, and align operational authorities with ADR-0066.

Runtime, resource-bound and exported-signal proofs remain pending delivery.

ADR: 0064, 0065, 0066

* feat(auth): own bounded subject admission cleanup

Keep reclamation and failed resources under one singleton owner before
allocation or debit, preserving existing quotas while exposing distinct
capacity and cleanup-fault outcomes. Exercise the approved races, DI shutdown
and exported signals with matching served and generated contracts.

ADR: 0064, 0065, 0066

* fix(auth): preserve no-store on every subject refusal

Apply the shared response policy even when a classified API path has no
endpoint. Make missing-header assertions fail and bind the retirement timer
to its accepted cadence so regression controls cannot pass silently.

ADR: 0064, 0065, 0066

* docs(roadmap): close subject admission implementation reviews

Record both fresh implementation review rounds and the verified header-proof
corrections while keeping complete local and final-source hosted evidence
under their own source identities.

ADR: 0064, 0065, 0066

* fix(auth): close HTTP boundary proofs and receipt chronology

Close composition and cross-root capability gaps in the existing
authentication census. Preserve owned cleanup despite diagnostic faults,
pin real reader and contract guards, and distinguish delivered status
from historical acceptance receipts.

ADR: 0036, 0040, 0041, 0052, 0064, 0065, 0066

* test(auth): close provider and anonymous metadata escape paths

Extend the bounded filter census to effective provider composition and
implemented anonymous contracts. Real DI and compiled metadata controls
prevent unchanged filter options from hiding executable policy changes.

ADR: 0064

* test(auth): pin effective action filters and authorization metadata

Close supported MVC composition channels that can change effective filters or
authorization without changing the global inventory or ordinary attributes.
Pair exact runtime inventories with compiled dirty and restored controls.

ADR: 0064

* docs(roadmap): close backend correction review rounds

Record both independent rounds and targeted confirmation of the committed
composition-proof fixes before starting the demo and SDK correction step.

ADR: 0064, 0065, 0066

* fix(web): bind demo receipts and preserve failure ownership

Keep local request refusal distinct from network failure and make demo
receipts describe the actual process outcome and observed source. Bind
both report files without relaxing browser budgets or cleanup ownership.

ADR: 0053, 0054, 0056, 0064

* fix(web): retain the first owned demo failure

Publish output refusal before physical shutdown and keep the same first
daemon error for every observer. Classify native coordinator cancellation
from its owned signal without replacing known faults or cleanup failures.

ADR: 0056

* fix(web): observe failing native exits before output closure

Keep the first native failure authoritative when paused or inherited
output delays close, while successful capture and physical cleanup
still retain their existing completion bounds. Real-child controls
prove the failure ordering and preserve complete successful output.

ADR: 0056, 0064

* fix(web): publish every unexpected daemon exit

A daemon's zero exit is still an unexpected failure. Observe it apart
from ordinary command success so delayed streams cannot replace the
first daemon outcome, while complete command output remains required.

ADR: 0056, 0064

* docs(roadmap): close systematic correction review rounds

Record verified fixes and independent follow-up closure while keeping
current-source hosted qualification separate from historical receipts,
local checks, production activation and maintainer merge approval.

ADR: 0056, 0064, 0065, 0066

* fix(ci): refresh architecture weights from complete hosted receipts

A censored assignment colocated expensive serial controls and exhausted
its existing deadline. Refresh only completed hosted selector costs,
retain unknown estimates honestly, and require both final-source layouts
without changing membership, topology, algorithm or time budgets.

ADR: 0063, 0064

* docs(roadmap): close measured timing correction reviews

Record both independent provenance and contract review rounds while
requiring fresh complete A/B evidence for the revised timing plan.
Clarify the existing distinction from ordinary future pushes without
changing any execution or qualification policy.

ADR: 0063, 0064

* fix(ci): require identified hosted timing sources

Require non-null source and run identities for hosted TRX timing records.
Keep historical local and console source shapes intact. Plant all three
missing-identity combinations against the actual plan validator.

ADR: 0063

* docs(roadmap): close provenance guard reviews

Record both independent review rounds and keep historical plan qualification
separate from the final-source full assignment required after the guard fix.

ADR: 0063

* docs(roadmap): propose P02b-6 realm and seed decision package

Define bounded development reconciliation and real identity proofs before
closing the remaining realm and issuance-lifetime gates. Preserve account
and secret ownership, separate provider timestamp semantics from configured
lifespan, and retain explicit approval before implementation.

ADR: 0004, 0036, 0064

* docs(roadmap): accept P02b-6 realm and seed decisions

Record the maintainer's approval before changing identity issuance or
existing development accounts. Register real-provider proof obligations
and retain the independent session, authorization and production gates.

ADR: 0004, 0036, 0064

* feat(identity): declare executable development realm identities

Make development issuance satisfy the strict tenant API profile while
keeping authentication personas in the typed seed declaration. Qualify
the committed import through real confidential code/S256 flow, owned
HTTPS and independent scope, lifetime and credential-refusal controls.

ADR: 0004, 0036, 0064

* fix(identity): close realm and vocabulary review gaps

Keep the existing G20 completeness fence aligned with every declared
identity, and reject optional mapper paths that can replace protected
claims. Preserve escaped literal keys and qualify implicit writers so
export drift cannot hide behind default-only issuance evidence.

ADR: 0004, 0036, 0064

* fix(identity): qualify client-role claim interpolation

Close the remaining export drift blind spot while retaining the provider's
safe built-in role path. Reconcile current guidance and record both completed
Step 1 reviews before starting warm-realm implementation.

ADR: 0004, 0036, 0064

* docs(roadmap): propose bounded server information read

Record the measured stock response that exceeds the accepted universal body
budget and propose one authenticated read exception. Keep implementation and
complete-core qualification pending maintainer acceptance.

ADR: 0004, 0064

* feat(identity): bound development realm transport and ownership

Keep setup credentials on the selected local service and retain each request
and lock through actual cleanup. These independent primitives retain the
accepted 256 KiB bound; planner activation and its version-read proposal remain
pending with the rest of Step 2.

ADR: 0004, 0064

* docs(roadmap): compare authenticated version probe alternatives

Record pinned-source analysis and isolated provider measurements for
server information and read-only partial export. Keep the accepted
256 KiB transport cap and the proposed exception pending approval.

ADR: 0004, 0064

* docs(roadmap): accept fixed server information response allowance

Record maintainer approval after the measured alternative comparison.
Keep ordinary responses, outbound bodies and all other ownership bounds
unchanged. Dependent implementation and provider qualification follow.

ADR: 0004, 0064

* fix(identity): confine server information response allowance

Permit 512 KiB only on the fixed authenticated successful bodyless
server-information GET. Keep every other response and outbound body at
256 KiB. Exercise exact bounds, closed resources and negative purposes.

ADR: 0004, 0064

* feat(identity): reconcile owned development realm state safely

Plan all bounded Admin REST changes before writes and independently
verify preservation and convergence. Keep existing accounts, secrets,
roles and unrelated configuration through warm and partial upgrades.

Qualify the actual shared core on PostgreSQL-backed HTTPS Keycloak,
including zero-write repeats and conflict refusals. Seed and demo
activation remains the next step after both independent review rounds.

ADR: 0004, 0036, 0064

* fix(identity): qualify stored identity visibility before reconciliation

Admin user projections cannot establish that hidden identity values are absent.
Refuse unqualified profiles and projected plan limits before any write, retaining
account state and enforcing the same bounded readers on subsequent passes.

ADR: 0004, 0036, 0064

* fix(identity): qualify inherited claims and preserve projected users

Reject protected group aggregation and inherited identity sources before writes,
retain safe group membership, and compare derived profile metadata separately
from stored accounts. Real provider controls cover uninterrupted warm upgrades,
nested groups, signed claim counterexamples and zero-write reruns.

ADR: 0004, 0036, 0064

* docs(roadmap): close realm review and qualify account self-service

Record the completed Step 2 correction reviews and the measured account-console
capability gap. Keep the bounded role and fixed-account mapper proposal pending
maintainer decision while the approved seed/demo lifecycle proceeds.

ADR: 0004, 0036, 0064

* feat(identity): share realm convergence across seed and demo

Validate private realm configuration before infrastructure work, build and run
the argument-free Release Seeder with its own credential, and await one shared
reconciler before public demo startup. Keep selected-stack identity and owned
cancellation through setup, with credential-free build and renderer processes.

ADR: 0004, 0036, 0064

* docs(roadmap): record first seed lifecycle review

Keep the Step 3 receipt separate from actual Compose qualification and
wrap the verified prose findings without changing its runtime contract.

ADR: 0004, 0036, 0064

* fix(identity): confine seed preparation credentials

Run selected stack and migration preparation under the seed owner so
matching inherited Keycloak credentials never reach EF children. Retain
Docker target controls with a fixed prerequisite allowlist and prove
the old Makefile dependency path fails the same confinement control.

ADR: 0004, 0036, 0064

* fix(identity): keep readiness under one seed owner

Own PostgreSQL readiness directly rather than through a nested CLI
whose detached Docker cleanup can outlive the preparation group.
Prove cancellation and deadlines stop owned work, and that restoring
the nested owner fails the same survival predicate.

ADR: 0004, 0036, 0064

* test(identity): retain process absence witnesses in seed proofs

Keep native process-group retirement evidence through both observation
samples so reused IDs cannot be attributed to owned work. Close Step 3
with independent correction reviews and final runtime seed receipts.

ADR: 0004, 0036, 0064

* feat(identity): qualify realm self-service and real token admission

Keep development account access limited to the approved builtin role and
mapper while proving protected identity fields against real Keycloak.
Exercise issued credentials through the production API and retain owned
provider teardown, physical read-only and complete CI discovery proofs.

ADR: 0004, 0036, 0064

* fix(ci): require executed realm cases alongside JUnit reports

An empty named Node suite can look like a passing JUnit case. Require
actual counters from the same invocation and exercise the real workflow
gate against empty-suite counterexamples. Retain measured provider case
weights so complete CI assignments use observed advisory costs.

ADR: 0004, 0063, 0064

* fix(tests): classify the offline realm gate control source

Keep the repository source census closed while declaring the new Python
counterexample helper as an exact offline test owner. Require the Node
reporter to remain visible to the live runtime census and retain the
completed Step 4 independent reviews and actual demo evidence.

ADR: 0056, 0064

* docs(roadmap): close P02b-6 implementation and review steps

Record actual provider and complete hosted backend evidence alongside the
known frontend correction, promote the two delivered behavioural rules,
and reconcile current carriers with all four reviewed implementation
steps. Keep final PR-head qualification and merge explicitly separate.

ADR: 0004, 0036, 0064

* docs(roadmap): identify the live PR qualification owner

Keep the completed implementation status distinct from dynamic PR checks
so the source-bound record does not imply a merge or stale test result.

ADR: 0063, 0064

* fix(identity): preserve setup prerequisites and failure cleanup

Retain tooling prerequisites without propagating application secrets,
classify aborted transport failures and remove failed lock markers.
Align finite seed preparation budgets and identity documentation with
current development behavior.

ADR: 0004, 0036, 0064

* docs(roadmap): record verified PR identity corrections

Record the two independent correction reviews and distinguish current
local evidence from the new-head hosted qualification.

ADR: 0004, 0036, 0064

* fix(identity): reject false convergence and close proof gaps

Refuse ambiguous account creation and incompatible login state before
claiming convergence. Preserve credentials without replaying mutations,
protect local setup sources, and independently verify provider identity,
profile preservation and owned cleanup.

Keep CI evidence bound to its actual attempt, distinguish missing receipts,
and require the complete reviewed test and fixture populations. Retain
failed qualification history instead of promoting partial reruns.

ADR: 0003, 0004, 0018, 0063, 0064

* style: align correction whitespace

Keep the fixture and dated verification prose within repository formatting
conventions without changing executable behavior.

ADR: 0004, 0064

* fix(identity): validate first reads and complete fixture census

Reject unsafe selected sources before Compose can perform a blocking
read. Bind fixture eligibility to actual declarations so qualified
collections and other explicit fixtures cannot silently miss the
independent-layout witness. Retain exact source-bound review receipts.

ADR: 0063, 0064

* fix(identity): bind Docker preflight to the selected environment

Inspect the same Docker inputs used by stack commands, including keys
removed from inherited configuration. Reject collection-attribute aliases
before fixture census filtering so they cannot silently narrow its proof.
Retain counterfactual controls and source-bound independent reviews.

ADR: 0063, 0064

* docs(roadmap): close independent correction reviews

Record both completed review rounds and independent verification of the
final alias and Docker-environment corrections. Keep hosted qualification
with the frozen source and live PR checks rather than old passing runs.

ADR: 0063, 0064

* fix(identity): keep seed authority generic and retain startup faults

Bind legacy identities to their complete typed declarations instead of
branching on demo usernames. Preserve existing finite provider startup
faults in failed measurements without exporting raw error messages or
changing execution and cleanup evidence requirements.

Record the failed frozen-source run and its diagnostic limits. Keep all
fixture, HTTP and whole-job deadlines unchanged.

ADR: 0018, 0063, 0064

* docs(roadmap): record startup diagnosis correction reviews

Record both independent rounds and exact local checks without promoting
them to hosted qualification or inventing a provider startup cause.

ADR: 0063

* test(identity): distinguish bounded provider startup failure families

The actual hosted fixture reaches the database stage and reports the
generic provider fault. Retain finite Docker status, reaper, socket and
filesystem classifications without exposing provider messages or bodies.
Do not infer a cause from the broader family or change startup budgets.

ADR: 0063, 0064

* test(identity): isolate pure startup diagnostics from fixture ownership

The source Docker guard correctly treats direct fixture references as
provider dependencies. Put pure finite classification in its own type
so offline canary controls remain Docker-free without weakening the guard.

ADR: 0063, 0064

* docs(roadmap): close provider classification correction reviews

Record independent final-source verification of finite failure codes
and the fixture-free diagnostic boundary, without claiming a repair.

ADR: 0063

* fix(ci): retain closed Docker startup failure families

Distinguish PostgreSQL SDK milestones and fixed daemon failure families
without exporting provider text or changing startup and cleanup policy.
Keep malformed and unknown responses on the existing generic diagnostic.

Validate seven offline cases, seven corpus/Docker-sweep cases, all 43
launcher controls and sixty combined shard/aggregate controls.

ADR: 0063

* fix(ci): contain malformed diagnostic Unicode

Map raw unpaired UTF-16 parser failures to the existing fixed fallback.
Four independently reproduced red controls now pass within the seven-case
offline suite with warnings as errors. Record first-round review and the
successful isolated Linux startup without claiming hosted reproduction.

ADR: 0063

* docs(roadmap): record daemon diagnosis correction reviews

Record both fresh second-round approvals, independent offline checks and
source-bound evidence limits before the next complete hosted A run.

ADR: 0063

* fix(testing): align fixture publishers and browser readiness

Publish application PostgreSQL on the identity fixtures' loopback address.
Share publication checks and require real configured/runtime inspection;
retain all database roles and ownership cleanup.

Poll only valid empty browser target lists within the original shared
five-second discovery budget. Preserve immediate invalid-response refusal,
closed diagnostics and owner/liveness checks.

Validate nine C# cases, seven corpus/Docker-sweep cases, 1756 guarded
frontend cases, 43 launcher controls and sixty shard/aggregate controls.
Record actual Linux before-red/after-green publication and role proofs.

ADR: 0003, 0063, 0064

* docs(roadmap): record publication correction first reviews

Retain both scoped approvals, independently executed controls and the
fourth frozen source's verified auxiliary evidence without promoting its
failed integration result or claiming an observed daemon version.

ADR: 0063

* docs(roadmap): complete publication correction reviews

Record both fresh second-round approvals and independent browser,
PostgreSQL privilege and cleanup checks before complete final-source A/B
qualification. Keep source-bound evidence limits explicit.

ADR: 0063

* fix(identity): clarify private setup and realm proof failures

Keep unsafe private-file refusals actionable without exposing their
contents, and make realm drift controls reject malformed profiles and
exercise username uniqueness independently. Extend owned fixture TLS
validity without changing trust. Record the existing issuance choice in
a Proposed ADR pending separate maintainer approval.

ADR: 0004, 0064

* docs(testing): preserve provider-only fixture boundaries

Describe the actual dependencies of provider-only and combined API tests
without implying every Keycloak proof configures application modules.
Record the first independent correction reviews and their verified fix.

ADR: 0004, 0064

* docs(roadmap): complete setup correction reviews

Record both independent correction reviews and their validation limits,
while keeping the dedicated issuance ADR Proposed until explicit approval.

ADR: 0004, 0064

* fix(identity): prove coupled development token expiration

Clarify the proposed issuance ADR's authority and provider consequences
without treating the review as acceptance. Preserve historical package
statements through dated adjacent corrections and name the actual
reconciliation owners.

Validate signed access and ID expiration together, including session
clamping, and plant an independent ID-expiration payload defect that
passes each fresh-window check. Retain the existing runtime and case
population.

ADR: 0004, 0064

* docs(roadmap): record first issuance correction review

Record independent proof/security and ADR/provenance approval while
retaining the second review and explicit ADR acceptance gates.

ADR: 0004, 0064

* docs(roadmap): complete issuance correction reviews

Record the fresh second-round proof and ADR reviews and their limits.
Keep formal ADR acceptance and current-head hosted qualification separate.

ADR: 0004, 0064

* docs(identity): accept development issuance decision

Record explicit maintainer acceptance of revised ADR-0067 and complete
its authority references in Security 11, the catalogue and local guides.
Preserve original phase approval and Proposed-state reviews with dated
adjacent disclosures.

Keep issuance configuration, API acceptance, session ownership and
source-bound qualification unchanged. The preceding ordinary CI failure
remains separately under investigation.

ADR: 0004, 0064, 0067

* docs(roadmap): record first issuance acceptance review

Record the independent authority and scope reviews of the approved
ADR-0067 carrier changes, with hosted failure investigation retained.

ADR: 0067

* docs(roadmap): complete issuance acceptance reviews

Record both completed independent carrier reviews and the source-bound
CI triage. Preserve the failed lifecycle case without inferring its
missing assertion diagnostic or waiving aggregate refusal.

ADR: 0067

* fix(ci): retain closed causal restart failure locations

Add the one observed lifecycle test source to the finite diagnostic
projection while keeping paths, stacks and provider messages private.
Plant the missing location in the existing control, observe it fail,
then pass all 43 offline launcher controls after adding the mapping.

This does not identify or fix the previous runtime assertion failure.
Success witnesses, aggregate refusal and execution budgets stay intact.

ADR: 0063

* docs(roadmap): record closed diagnostic correction review

Record independent privacy and counterexample reviews of the one-source
mapping, including all 43 controls and the removed-mapping negative.

ADR: 0063

* docs(roadmap): complete closed diagnostic correction reviews

Record the fresh second-round privacy and proof checks, including the
missing-map negative, all offline controls and byte-preserved execution.
Keep the preceding failed lifecycle receipt unwaived.

ADR: 0063

* fix(tooling): preserve safe development lifecycle operations

Keep teardown usable before realm convergence, retain closed setup diagnostics,
and confine private configuration and migration credentials to their owners.
Add actual-launcher controls without changing accepted realm capabilities.

ADR: 0004, 0053, 0054, 0064, 0067

* test(identity): strengthen convergence and CI gate counterexamples

Exercise retained-account and transport boundaries independently, keep the
realm gates mandatory, and project only recognized safe failure kinds.
Record source-bound checks without treating repeat passes as a root cause.
Guard the documented migration build before executing no-build EF.

ADR: 0004, 0063, 0064, 0067

* docs(decisions): propose development identity visibility preparation

Keep the demonstrated hidden-identity refusal while examining a bounded
metadata-first exception. Record the independent historical-bootstrap scope
prerequisite explicitly; approval and dependent runtime remain pending.

ADR: 0004, 0064, 0067, 0068

* docs(identity): bound historical realm upgrade qualification

Separate profile visibility preparation from fully planned detachment of only
three qualified stock console edges. Retain compatible scopes, existing grants
and explicit approval before dependent runtime. Record actual feasibility,
completed correction reviews and the remaining proof boundary honestly.

ADR: 0004, 0064, 0067, 0068

* test(tooling): declare isolated child test environments

Supply the test mode required by Next's process environment types without
inheriting application credentials into child fixtures. Full typecheck,
lint and all 197 affected cases pass. Record the proposed warm-realm
correction steps and reflow the first document review's long lines.

ADR: 0064, 0067

* docs(roadmap): record final correction and proposal reviews

Record both fresh review rounds for the isolated fixture typing fix and
the final Proposed warm-realm correction. Preserve the approval hold and
separate author checks, private feasibility and hosted qualification.

ADR: 0064, 0067

* fix(identity): resolve assigned console scopes by bound ID

Admin assignment endpoints return only ID and name. Read and bind the
complete representation before checking protocol, while preserving all
existing compatible allowance and mapper checks. Add independent graph,
identity, readback and transport-cap counterexamples; 256 guarded Node
cases and six workflow-gate controls pass.

ADR: 0004, 0064

* docs(decisions): qualify preparation authority and console evidence

Require all identity-independent refusals before preparation, preserve
readable prior definitions, and specify preparation diagnostics, write
accounting and exact assignment-only DELETE authority. Retain shipped
catalogue status with pending extensions. Correct raw provider anchors
and distinguish actual console token effects from unproved POST/runtime
behavior. Record conditional maintainer acceptance authority and the
separate source-bound CI failure without guessing its cause.

ADR: 0004, 0064, 0067

* fix(ci): retain closed native settlement failure locations

Add the existing settlement test file to the finite diagnostic source
projection. Verify exact and near-match handling without exposing raw
paths or errors. All 43 offline controls pass. This does not infer the
lost CI assertion or alter runtime, deadlines or success witnesses.

ADR: 0063

* docs(roadmap): record revised decision inspection and failure limits

Record the first fresh review of the compatible-read correction and
conditional decision revision. Reflow its one minor finding and clarify
what the failed launcher envelope can and cannot establish.

ADR: 0063, 0064, 0067

* docs(decisions): accept bounded warm-realm qualification

Accept ADR-0068 under the maintainer's conditional authority after both
fresh revision reviews. Disclose the two bounded phase replacements and
historical remedy follow-up; reconcile authority headers, architecture,
guidance and index. Preserve shipped catalogue status/counts while the
expanded obligations remain explicitly pending. Acceptance authorizes
the three-step implementation, without claiming automatic-path proof.

ADR: 0004, 0064, 0067, 0068

* feat(identity): qualify stock console assignment normalization

Bind complete historical scope, mapper and role representations before
removing only three approved account-console assignments. Preserve the
compatible path, keep DELETE authority opaque and requalify explicit
partial-progress reruns without replay or a durable marker.

Commit a credential-redacted historical fixture, fixed canonical baseline
and independent real-provider reproduction. The ordinary production path
performs sixteen writes, then zero after test-owned metadata setup.
Automatic preparation and the remaining token/self-service proofs retain
the next steps' gates.

ADR: 0004, 0064, 0067, 0068

* test(identity): cover every interrupted console assignment

Persist uncertain-response and cancellation controls at all three DELETE
positions. Verify the exact durable prefix, no replay, last-edge handoff
to compatible preservation and explicit zero-write convergence.

Record the first independent Step 1 review and its verified proof gap.
Runtime behavior and mutation authority remain unchanged.

ADR: 0068

* docs(roadmap): close the first warm-realm correction step

Record both fresh review rounds, the persisted interruption correction
and its independently verified convergence. Keep preparation, complete
automatic-path evidence and final hosted qualification explicitly pending.
Clarify that the Node census guards files and counts, not test semantics.

ADR: 0068

* feat(identity): prepare warm-realm identities before fresh planning

Qualify independent prerequisites before the bounded metadata exception,
then discard every provisional projection before admitting ordinary writes.
Keep uncertain dispatched progress visible through failures and cleanup.
Actual historical provider controls prove convergence and explicit recovery.

ADR: 0068

* fix(identity): qualify visible facts before warm-realm preparation

Keep already observable identity and profile refusals ahead of metadata
preparation. Preserve mapper refusal codes through stock qualification and
retain dispatched metadata notices through the seed and demo entry owners.
Actual provider regressions and clean counterpart controls bind these fixes.

ADR: 0068

* docs(roadmap): record verified warm-preparation corrections

Bind the closed first-round findings and caller/mapper regressions to their
committed fixes and independent checks without claiming final qualification.

ADR: 0068

* docs(roadmap): close reviewed warm-realm preparation step

Record both fresh review rounds, verified correction coverage and remaining
complete-path qualification without treating partial evidence as release proof.

ADR: 0068

* test(identity): prove historical realm credentials and API

Qualify the approved warm upgrade with usable MFA, signed application reads
and stored account changes. Retain source-bound entry evidence and measured
case assignments while keeping incomplete public qualification explicit.

ADR: 0004, 0064, 0067, 0068

* docs(roadmap): record warm qualification and Step 3 reviews

Retain both historical demo outcomes and their distinct evidence limits,
then record the two fresh independent review rounds before final hosted
assignment qualification. No earlier failure is relabelled as success.

ADR: 0063, 0068

* test(ci): bound ingress lookup and retain settlement facts

Remove an unrelated unbounded informational lookup from the native ingress
fixture while preserving real request settlement and all security checks.
Exercise case-bound diagnostics through the pinned test adapter and retain
failed qualification receipts without guessing their missing root cause.

ADR: 0047, 0055, 0063, 0068

* docs(roadmap): record first CI correction review

Retain independent source and actual adapter checks without treating
historical green assignments as a waiver for the failed A3 receipt.

ADR: 0063, 0068

* docs(roadmap): close independent CI correction reviews

Record the fresh second review and clarify the informational fetch bound
without claiming a universal response-body deadline or waiving A3.

ADR: 0063, 0068

* test(jobs): attribute settlement loss to its execution

Preserve the original held Outcome invariant without assigning later
Finalize observations to it. Prove the distinction with a real locked
Finalize commit, conservative renewal refusal and actual cleanup, and
retain closed identity attribution across all failure boundaries.

ADR: 0047, 0059

* test(jobs): join issued settlement flights before cleanup

Await actual flights before positive ownership joins so an early
assertion cannot retain unfinished work permanently. Preserve the first
failure and qualify the cleanup path with a real held-COMMIT negative
and bounded, case-bound cleanup observations.

ADR: 0047, 0059

* docs(roadmap): close independent attribution reviews

Record the verified cleanup correction, both fresh review rounds and
the exact whitespace-only source binding. Keep current-head hosted
qualification in the PR and preserve every earlier failed receipt.

ADR: 0047, 0059, 0068

* test(jobs): preserve recurrence failure and cleanup observations

Keep the first actual recurrence test fault through independent cleanup and
retain only case-bound finite diagnostics. Real adapter controls preserve the
original assertion even when cleanup also fails; production behavior and all
existing waits remain unchanged.

ADR: 0047, 0059, 0063, 0068

* docs(roadmap): record recurrence diagnostic first reviews

Record independent ownership and export checks against actual adapter failure,
cleanup, source and archive evidence while preserving the failed hosted run.

ADR: 0047, 0059, 0063, 0068

* docs(roadmap): close recurrence diagnostic review rounds

Bind both fresh review rounds to actual failure preservation, positive cleanup
and complete retained evidence, with hosted qualification and merge separate.

ADR: 0047, 0059, 0063, 0068

* test(jobs): isolate settlement proofs from pre-ack renewal races

Schedule the real renewal pacing callbacks around Outcome settlement, retain
actual timer cleanup, and prove the unrelated Prepare-lock refusal against
PostgreSQL. Preserve exact cases, deadlines and production policy. Retain the
failed CI and partial-rerun evidence with bounded diagnostics.

ADR: 0047, 0059, 0060, 0063

* docs(roadmap): record first settlement scheduling reviews

ADR: 0047, 0063

* test(jobs): arm settlement deadlines before publication holds

Create the actual normal deadline timer before the fixture publication hold.
Preserve real durations, callback/factory ownership and exact case identities.
Retain fresh clean and exclusion-control evidence, and explicitly refuse the
ordering control's unconfirmed internal cleanup witness.

ADR: 0047, 0059, 0060, 0063

* docs(roadmap): record independent deadline fix verification

ADR: 0047, 0063

* fix(ci): audit links against immutable event commits

Compare the PR event base snapshot directly with the checked-out tree instead
of fetching a later shallow base branch. Exercise the actual workflow owner
against real squash graphs, missing bases and broken links. Preserve strict
aggregate identity refusal and record the merged implementation accurately.

ADR: 0007, 0041, 0063

* docs(roadmap): record link audit correction review

Record both independent first-round reviews and the actual workflow and
corpus checks. Complete hosted A/B qualification remains pending on an
open follow-up PR; closed-PR identity evidence is not waived.

ADR: 0007, 0041, 0063

* docs(roadmap): close link audit correction reviews

Record the different second review pair and independently reproduced
old-owner failures. Keep complete final-source hosted qualification
pending on the open follow-up PR.

ADR: 0007, 0041, 0063

* fix(ci): classify Markdown audit regression tooling

Register the new Python proof script in the explicit non-runtime census.
The real frontend gu…

Author: 3 people

.claude/skills/add-background-job/SKILL.md

@@ -50,7 +50,7 @@ Use [implement-task](../implement-task/SKILL.md) as the substantive entry point.
 ### 1. Check the delivered boundary
 
 Read the feature roadmap and current
-[P02b-4 record](../../../docs/roadmap/phase-02b-events-auth.md#p02b-4-decision-package-2026-10-15).
+[P02b-4 record](../../../docs/roadmap/phase-02b-delivery-log.md#p02b-4-decision-package-2026-10-15).
 P02b-4 intentionally carries no production business definitions or recurrence
 manifests. The first feature must explicitly reconcile that infrastructure-only
 census when its own accepted phase delivers real definitions.

.claude/skills/add-frontend-route/SKILL.md

@@ -135,7 +135,7 @@ entry before rebuilding downstream request headers. The caller verifies the
 envelope again. G35 and G36 are recorded in
 [Phase 02d's decision register](../../../docs/roadmap/phase-02d-walking-skeleton.md#the-decision-register).
 Don't read `host` directly inside a page. The
-[public entry matrix](../../../docs/roadmap/phase-02d-walking-skeleton.md#public-entry-matrix)
+[public entry matrix](../../../docs/roadmap/phase-02d-delivery-log.md#public-entry-matrix)
 is authoritative: bootstrap the live host before locale/redirect decisions;
 enabled-locale membership precedes `courses` shorthand and exact `/studio` or
 `/portal` scaffold handling. Disabled/malformed/unknown prefixes fail closed;
@@ -148,7 +148,7 @@ through bootstrap and the configured caller; Phase 11 owns participation/samplin
 requires native GET/HEAD admission on every HTTP callback path, including
 middleware-exempt health/assets/scaffolds, with masked no-store refusal of other
 methods and bodyless HEAD. Production upgrades close; development retains only
-validated GET HMR. The [remediation record](../../../docs/roadmap/phase-02d-walking-skeleton.md#remediation-step-2--native-ingress-and-url-boundary)
+validated GET HMR. The [remediation record](../../../docs/roadmap/phase-02d-delivery-log.md#remediation-step-2--native-ingress-and-url-boundary)
 owns validation and both independent review rounds. Do not add
 Server Actions/write routes or WebSocket consumers without an explicit owning
 Phase 02b/Phase 06
@@ -238,9 +238,9 @@ locale, document language and actual resolved-label language.
 
 The guarded frontend suite supplies ICU, argument and callsite checks. No
 `lint:i18n` command or screenshot/axe tooling exists. The
-[Step 1 delivery record](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-step-1-localization-and-document-foundation)
+[Step 1 delivery record](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-step-1-localization-and-document-foundation)
 owns foundation validation; the
-[packet closeout](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-packet-closeout-2026-10-10)
+[packet closeout](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-packet-closeout-2026-10-10)
 records the delivered product proof and scoped manual accessibility checks.
 
 ### Step 8: Public-site SSR caching
@@ -296,7 +296,7 @@ document, one per fixed status/scaffold document and three per followed missing
 document. Metadata/layout/page/UI share the admitted snapshot without another
 bootstrap or cross-request cache. HEAD/RSC/prefetch and Flight fallback require
 separately proven counts. The
-[Step 3 record](../../../docs/roadmap/phase-02d-walking-skeleton.md#adr-0055-step-3--production-admission-proof-and-closeout)
+[Step 3 record](../../../docs/roadmap/phase-02d-delivery-log.md#adr-0055-step-3--production-admission-proof-and-closeout)
 records passing production replacement proofs, completed reviews and verified fixes.
 
 ### Step 10: Tests
@@ -319,7 +319,7 @@ records passing production replacement proofs, completed reviews and verified fi
   catalog/course/lesson routes under
   [ADR-0056](../../../docs/decisions/0056-public-demo-browser-and-lighthouse-enforcement.md).
   Preserve its production-page admission, hard budgets and owned cleanup. The
-  [P7 Step 4 record](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-7-step-4--ci-enforcement-and-phase-exit-2026-10-11)
+  [P7 Step 4 record](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-7-step-4--ci-enforcement-and-phase-exit-2026-10-11)
   owns completed G44/G45 enforcement; Phase 06 still owns broader Playwright/axe
   coverage.
 

.claude/skills/add-i18n-key/SKILL.md

@@ -24,9 +24,9 @@ Manage user-facing translations in `apps/web` consistently per
 > [ADR-0027](../../../docs/decisions/0027-frontend-i18n.md) selects exact
 > `next-intl` 4.14.9 and the catalogue home below. Step 1 installs the runtime,
 > complete English/Turkish catalogues and guarded ICU/callsite checks. Its
-> [delivery record](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-step-1-localization-and-document-foundation)
+> [delivery record](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-step-1-localization-and-document-foundation)
 > owns foundation validation; the
-> [packet closeout](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-packet-closeout-2026-10-10)
+> [packet closeout](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-packet-closeout-2026-10-10)
 > records the scoped product and manual accessibility evidence. No
 > `pnpm lint:i18n`, `no-literal-strings`, `_deprecated.json`, screenshot or
 > `axe-core` task exists today; do not claim those checks run.

.claude/skills/add-integration-event/SKILL.md

@@ -30,14 +30,14 @@ owns immediate producer admission, completion and payload policy. P02b-1
 Steps 2/3 implement immediate enqueue, payload admission, successful-save
 collection and the completed-provisioning publisher. Step 4 implements the
 production censuses and catalogue enforcement; the
-[delivery record](../../../docs/roadmap/phase-02b-events-auth.md#p02b-1-step-4--producer-enforcement-and-closeout-2026-10-12)
+[delivery record](../../../docs/roadmap/phase-02b-delivery-log.md#p02b-1-step-4--producer-enforcement-and-closeout-2026-10-12)
 owns final verification and review status.
 Accepted [ADR-0046](../../../docs/decisions/0046-durable-event-delivery-and-recovery.md)
 owns dispatcher recovery, subscription readiness and the shared inbox contract.
 P02b-2 implements producer dispatch; P02b-3 Steps 1–4 implement durable
 acceptance, shared inbox/ledger storage, independent execution and scheduling.
 Step 5 supplies the real default subscriptions and semantic Seeder handoff; the
-[delivery record](../../../docs/roadmap/phase-02b-events-auth.md#p02b-3-step-5--useful-defaults-and-semantic-seed-handoff-2026-10-13)
+[delivery record](../../../docs/roadmap/phase-02b-delivery-log.md#p02b-3-step-5--useful-defaults-and-semantic-seed-handoff-2026-10-13)
 owns validation/review status.
 
 ## When to use

.claude/skills/add-page-block/SKILL.md

@@ -66,7 +66,7 @@ and [17-page-builder.md](../../../docs/architecture/17-page-builder.md).
 > and no active URL sink. The wider registry and component sketches below remain
 > Phase 04/05 and Phase 06 targets. The existing key lists in
 > `src/lib/customization/` are not renderer implementations. See the
-> [accepted package](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-accepted-answers).
+> [accepted package](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-accepted-answers).
 
 `RegisterPrimitive`, `BlockRenderer`, `resolver.registerPrimitive` and
 `useContentEntries` below are illustrative future APIs, not existing symbols to
@@ -216,7 +216,7 @@ the page.
   planted controls, localized product-page semantics and real manual keyboard,
   focus, reflow, contrast and screen-reader evidence. Step 3 implements the
   applicable lint controls and synchronous lesson semantics. The
-  [Step 4 record](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-step-4-product-proof-and-accessibility-closeout)
+  [Step 4 record](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-step-4-product-proof-and-accessibility-closeout)
   records product proofs and the scoped manual browser/screen-reader checks.
 - [Performance Standards](../../../docs/standards/15-performance.md) governs pages
   embedding the block. P02d-7's shared `make demo DEMO_MODE=ci` proof supplies

.claude/skills/code-review/SKILL.md

@@ -83,7 +83,7 @@ Walk every change against the project's
 | **Authn / authz** | Every new endpoint has `[Authorize(Policy=…)]` or `[AllowAnonymous]` with a comment. Policy keys exist in the permission registry. Resource-scope handlers (`instructor` edits own course only) present where needed. |
 | **Tenant id from the resolved context only** | Resolved per [ADR-0036](../../../docs/decisions/0036-tenant-resolution-trusted-inputs.md): from the host lookup of the effective host, or on a platform host from validated claims confirmed by live membership; off HTTP, from the validated authoritative job row or the integration-event envelope. Never from a request body, query string, cookie or tenant header — `X-Tenant-Id` and `X-Organization-Id` are assertions that can only reject, on every hop. Check command and DTO surfaces. |
 | **SQL injection** | EF Core LINQ or `FromSqlInterpolated`; never raw string concatenation. Raw SQL has parameters. |
-| **XSS** | No `dangerouslySetInnerHTML` outside a sanitisation wrapper; CSP nonces in place; markdown via allowlist. Nothing sets a CSP today: the [standards index](../../../docs/standards/README.md#honest-status-today) row for Security Standards carves § HTTP Headers out to [Phase 11](../../../docs/roadmap/phase-11-production-hardening.md#security), so a missing nonce is not a Blocker until that phase sets one. Accepted P02d-6 G42 requires atomic four-color validation and a fixed style element, with whole-palette fallback; output must be safe without CSP. [The accepted package](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-accepted-answers) owns its proof obligations; acceptance alone is not delivery. |
+| **XSS** | No `dangerouslySetInnerHTML` outside a sanitisation wrapper; CSP nonces in place; markdown via allowlist. Nothing sets a CSP today: the [standards index](../../../docs/standards/README.md#honest-status-today) row for Security Standards carves § HTTP Headers out to [Phase 11](../../../docs/roadmap/phase-11-production-hardening.md#security), so a missing nonce is not a Blocker until that phase sets one. Accepted P02d-6 G42 requires atomic four-color validation and a fixed style element, with whole-palette fallback; output must be safe without CSP. [The accepted package](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-accepted-answers) owns its proof obligations; acceptance alone is not delivery. |
 | **CSRF** | Server Actions / Auth.js session check; non-Action mutating fetches carry CSRF tokens. |
 | **Secrets** | No secret in source / appsettings / env-file-committed; reads through `ISecretProvider`. No log of token / password / national id. |
 | **PII redaction** | `[PiiSensitive]` fields carry `SensitiveTokenCatalog.RedactedValue` in audit snapshots — the property stays, so the diff still records *that* it changed; logs don't carry raw PII. |

.claude/skills/implement-task/SKILL.md

@@ -171,7 +171,8 @@ match the change:
   for prerequisites, artifact review and cleanup. The Playwright library proof
   covers nine seeded pages and 27 audits; Phase 06 owns the full Playwright Test/
   axe suite. There is no `pnpm test:a11y` or `pnpm test:e2e` script.
-- Documentation-only → broken-link sweep + `docs/analysis/` residual scan
+- Documentation-only → `make lint-docs` (whole-tree fragment audit and roadmap
+  structure guard) + broken-link sweep + `docs/analysis/` residual scan
   (see Step 7's link audit).
 
 A failing test is the work telling you to keep going. Fix the underlying issue;
@@ -187,7 +188,14 @@ list, update what applies, leave nothing stale:
 
 - **Roadmap.** Did this phase deliver something new? Update the phase doc's
   Deliverables / Completion Criteria. Did this complete a phase exit
-  criterion? Note it.
+  criterion? Note it. A packet's decision package, step record, review round,
+  correction or closeout is a dated `###` entry under its packet in the phase's
+  `phase-<id>-delivery-log.md`, never a section of the phase doc; the phase
+  doc changes only the packet's Status row. Read a log through the generated
+  index at its top, never whole, and run `make docs-index` after adding an
+  entry. Do not narrate packet status in
+  `CLAUDE.md`, the repository README or the roadmap index
+  ([ADR-0069](../../../docs/decisions/0069-phase-documents-and-delivery-logs.md)).
 - **Standards.** Did the change introduce a new rule or refine an existing
   one? Update the relevant standard + cite the ADR (use
   [write-adr](../write-adr/SKILL.md) if the rule deserves one).

.claude/skills/local-dev-setup/SKILL.md

@@ -313,7 +313,7 @@ state.
 ## Validation
 
 [ADR-0053](../../../docs/decisions/0053-trusted-public-server-rendering.md)
-and the [P5 package](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-5-decision-package-2026-10-08)
+and the [P5 package](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-5-decision-package-2026-10-08)
 own the accepted host/TLS/transport contract. P02d-7 supplies foreground `make demo`
 and CI browser/audit mode. Follow README Quickstart for production-build launch,
 owned cleanup, retained local data and stale-lock handling. The packet's Step 4

.claude/skills/run-tests-locally/SKILL.md

@@ -173,7 +173,7 @@ an existing user process. P6 adds separate production product modes for foundati
 pagination, presentation, concurrent isolation and freshness/failure states. Those
 HTTP/HTML/RSC proofs do not claim browser or screen-reader execution; P6's manual
 accessibility closeout is recorded with its tested scope in the
-[packet closeout](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-packet-closeout-2026-10-10).
+[packet closeout](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-packet-closeout-2026-10-10).
 New UI changes require their own applicable manual checks; P7 supplies the narrow
 seeded browser demo described below.
 
@@ -188,7 +188,7 @@ to its certificate's public-key fingerprint; it does not use a personal profile.
 Browser observations cover a refused Flight followed by stock Next's fresh document
 navigation and separately counted API calls. HMR controls cover source recompilation
 and a fresh live site snapshot in the same development process. The
-[Step 3 record](../../../docs/roadmap/phase-02d-walking-skeleton.md#adr-0055-step-3--production-admission-proof-and-closeout)
+[Step 3 record](../../../docs/roadmap/phase-02d-delivery-log.md#adr-0055-step-3--production-admission-proof-and-closeout)
 owns actual execution, completed reviews and verified fixes. This probe remains
 separate from P7's browser demo/Lighthouse and Phase 06's full Playwright Test/axe.
 
@@ -221,6 +221,25 @@ It runs nine linked product pages and 27 cold Lighthouse audits over one unchang
 API/build/database, with real admission pacing and certificate-specific trust.
 Missing browser installation fails the proof rather than skipping it.
 
+The hosted workflow bounds APT mirror acquisition with one retry and 15-second
+HTTP/HTTPS timeouts in an exclusively created temporary configuration fragment.
+It checks the effective settings as root without evaluation, then removes only
+that fragment on shell exit. Sources, package verification, the complete
+Playwright dependency set and the five-minute installation limit stay intact.
+This is hosted setup handling, not a workstation prerequisite or a guarantee of
+total setup duration. The actual workflow-shell controls live in
+`frontend/apps/web/src/test/public-demo-ci.test.ts`.
+
+The workflow's outer setup/proof allowance ends at minute 17 from its first
+step, reserving three minutes within the same 20-minute job ceiling. The native
+proof and cleanup retain their separate 12-minute and 30-second caps. Sandbox
+cleanup and workflow-receipt commands receive TERM after 15 seconds and KILL
+after five more; artifact upload retains its one-minute step limit. The nominal
+35 + 20 + 20 + 60-second tail leaves 45 seconds for runner/post overhead, not a
+worst-case scheduling guarantee. A forced stop or unconfirmed cleanup fails.
+This job restores the existing NuGet cache without a save post-hook; cache
+misses still use ordinary dependency restoration.
+
 On GitHub-hosted Linux runners, run `node scripts/ci-public-chromium.mjs prepare`
 after installation and before the lifecycle, then run
 `node scripts/ci-public-chromium.mjs cleanup` in an always-running cleanup step.
@@ -242,7 +261,7 @@ screenshots. Proof and owned cleanup must both pass. Archive only this sanitized
 artifact directory; private configuration, certificates, keys, profiles and raw
 process logs are excluded. Existing artifacts must be moved aside before another
 run so stale evidence cannot pass. The
-[P7 delivery record](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-7-step-3--browser-and-audit-proof-2026-10-11)
+[P7 delivery record](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-7-step-3--browser-and-audit-proof-2026-10-11)
 owns local proof/review evidence; the packet's Step 4 record and
 [branch protection](../../../.github/CONTRIBUTING.md#branch-protection-settings-on-main)
 own real CI receipts and required-check activation. Local success alone does not
@@ -365,7 +384,7 @@ record and CONTRIBUTING; do not infer them from a local audit.
   applicable `jsx-a11y` rules and localized page-semantics checks, plus manual
   keyboard, focus, reflow, contrast and screen-reader evidence. Acceptance does
   not claim those controls pass; implementation records their actual results in
-  [Phase 02d](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-accepted-answers).
+  [Phase 02d](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-accepted-answers).
 
 ## Common pitfalls
 
@@ -386,6 +405,6 @@ record and CONTRIBUTING; do not infer them from a local audit.
   standard does not prove implementation. Accepted P02d-6/G43 requires earlier
   failing lint/semantics controls and actual manual assistive-technology evidence;
   DOM assertions cannot substitute for a screen reader. Delivery is recorded in
-  [Phase 02d](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-6-accepted-answers).
+  [Phase 02d](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-accepted-answers).
 - **CI-only failures.** Usually a race or timing assumption. Use `--blame-hang`
   + `--blame-crash` locally.