docs: record 2026-09-09 stack-collapse merge ledger

docs/product-technical-gap-baseline.md

@@ -1,6 +1,6 @@
 # Product and technical gap baseline
 
-Last reconciled: 2026-09-08
+Last reconciled: 2026-09-09
 
 This ledger records PolicyWeave's commercialization gap from PRD/ADR/TRD/architecture, implementation, authoritative legal-source evidence, review findings, and live GitHub state. Live Check conclusions are not committed because they change outside the repository; merge decisions must re-fetch the exact current PR head and live ruleset.
 
@@ -50,6 +50,8 @@ Queue RCA then observed distinct stale heads `cbfbdae4a4bb72433d7bdcc51afdbd8a29
 
 The restart/restore slice remains bounded CI evidence and does not enable a hosted adapter. After the initial atomic-seed repair, review found that paired collection/applies and no-collection/none fixtures could not prove collection and retention are independent, the restored database re-exercised only the no-collection trigger, and a nullable restored `service_name` could evade `<>` through SQL three-valued logic. Test-only head `5e54834873e125b3e3ce4f599e4037e017330638` added the missing cross-state and NULL-safe assertions; exact-head CI `34204279846` was RED only in the restore step with `restart did not preserve independent collection and retention facts`. The next commit seeds a valid collecting revision with `retention_status = none`, keeps authored service and collection-item assertions NULL-safe, and executes status-side missing-rule plus rule-side unexpected-rule transactions against the restored database. Pre-documentation head `202e69d95c94e4432365d6599016a371c0f2cbc3` CI `34204464388` then passed the complete suite. A later exact-head review found that the nullable authored service URL was not selected or asserted even though the evidence claim covered complete service values. Mutation-probe head `aaef3b5489493669cdb53c08a72b6a109fc0b687` deliberately nulled that URL after restart; CI `34205653966` passed every preceding step and failed only the new NULL-safe restore assertion. Commit `57732c6dbec872ad29e97a7f22096dbba9613e9a` removes the probe while retaining literal name/URL checks. These immutable runs establish the TDD transitions but are not substitutes for the final current-head verdict. PR #9 merged into the concurrent-writer stack at `5309a6141d8f3f0c89e9cfdaae04f4644a8dfcd4`. The TypeScript restore contract now binds restored service URL survival and the collecting-without-retention cross-state fixture. This is CI durability evidence, not operational backup, tenant authorization, or a released datastore.
 
+On 2026-09-09 the review-to-merge loop collapsed the writer stack through ordinary merge commits without force-push, branch deletion, or protection changes, following the PR #9 precedent for unprotected stacked branches. PRs #2, #3, #4, #5, #6, #7, and #8 merged bottom-up between 01:10:44Z and 01:14:13Z, each with exact-head `verify` GREEN, zero unresolved review threads, and MERGEABLE/CLEAN state re-fetched immediately before its merge. The local-only restore-contract commit `878d0ce` was pushed as a new branch and opened as successor PR #14 on the PR #8 head; its Codex P2 review correctly showed the URL and `collection_without_retention_count` markers could not detect a coupled revision-`...0003` seed-plus-query change from `none` to `applies`. Commit `d0da193` binds the `...0003`/`none` seed tuple, its `support_email` item seed, and the revision-specific query predicates together; a negative control proved the old markers pass that coupled mutation while the new predicates fail it, and the review thread was resolved with that evidence. CI `34298653319` passed on `d0da193`, and PR #14 merged at 01:25:12Z. PR #13 (dependency pin and toolchain classification for issue #12) merged at 01:19:32Z on its immutable GREEN pair of head `eff7ec19f511` and CI `34251045288`, advancing the docs readiness branch to `bbea5c9`, whose fresh `verify` (`34298735574`) is GREEN. No PR was closed: 9 merges leave drafts #1, #10, and #11 open, each retaining a valid delta. `develop` still declares 16 `latest` occurrences, which explains PR #1's `dependency-review` failure; the pinned manifest (zero `latest`) sits at the top of the side chain and reaches `develop` only through the PR #10 to #11 to down-chain successor path. PR #1's remaining failures are the two CodeQL compatibility analyses plus `dependency-review`; `verify`, Noema, OpenCode, Strix, Semgrep, Trivy, OSV, and Scorecard are GREEN on its current head. Central-workflow run logs live in the organization central repository, so a leaf-side run fetch returns 404; such incidents go through the central owner path rather than leaf-side churn or bypass. The chain tip carrying the full writer delta is `origin/codex/policyweave-concurrent-writer-evidence` (`df9eef5`), with sibling successors `codex/policyweave-json-export` (PR #10, draft; its buyer-visible export enablement needs product review plus a base update now that its base moved) and this ledger branch stacked above it. The repository has no scheduled workflow (only `ci.yml`, no `schedule` trigger), so the hourly cadence is served by the autoresearch loop's own status messages rather than an in-repo scheduler. This remains CI durability evidence with no hosted adapter, tenant authorization, audit, encryption, or released datastore.
+
 ## Current baseline
 
 | Area | Evidence | Status | Commercialization gap | Owner/action | Next verification |
@@ -77,7 +79,7 @@ The Proposed aggregate root is the minimal `policy_revision` boundary. The no-co
 A publishable release requires complete fact-to-warning navigation, deterministic rendering of captured source facts, no inferred customer operational facts, truthful first-responsibility startup/progress, explicit unresolved-review blocking across the seven authoring responsibilities, an explicit no-collection path that does not infer unrelated processing facts, independent explicit retention status, immutable reviewed publication revisions, accessible responsive interaction, authoritative source/version traceability for legal rules, hosted security/privacy evidence, and exact-head CI/security/independent review. Buyer-facing wording describes assistance and reviewability, never a compliance guarantee or an internal implementation boundary.
 
 ## Active commercialization order
-1. Reacquire exact-current-head CI/security/SAST/central workflow execution and independent approval; merge PR #1 only through ordinary protection.
+1. Land the full-delta tip (`codex/policyweave-concurrent-writer-evidence`) into `develop` through a successor PR with exact-head evidence; advance draft #10 (export enablement needs product review plus a base update) and draft #11; clear PR #1's CodeQL-compat failures through the central owner path, deliver pins down-chain, and secure independent approval (sole-maintainer approval is the structural blocker); merge PR #1 only through ordinary protection.
 2. Extend the exact-head responsive/accessibility evidence with screen-reader checks, native browser-zoom automation when the harness supports it, and manual records; CSS focus contrast, logical step-focus transfer, focused-heading viewport visibility, retention transitions, effective 200% browser-zoom reflow, and current desktop/tablet/mobile screenshots are already verified.
 3. Preserve exact-head PostgreSQL 18 migration, domain-error, two-session lock, restart, and dump/restore evidence, then prove tenant authorization, immutable audit, and encryption before enabling any hosted adapter.
 4. Implement secure review/publication with immutable releases and explicit supersession.