docs: record docstring and re-verification turn in ledger

docs/product-technical-gap-baseline.md

@@ -75,6 +75,8 @@ The dependency-governance pass found that every direct npm declaration was eithe
 
 The successor landed this side chain in `develop` order via PR #18 (successor head `828ecf1`, parents `8178ba6` + `83fb9f8`, verify `34313155294` GREEN, zero review threads, merged 05:06:01Z): the above export evidence plus the dependency-governance delta arrived together, preserving both histories without force-push. Predecessor merges in this turn: PR #10 (export, head `cef8c0b`, verify `34301731941` GREEN, 7/7 threads resolved, merged 04:32:57Z after `gh pr ready` lifted the draft merge block) and PR #11 (readiness plus pins, head `77bf3c2` after the scope-sentence correction, verify `34311980712` GREEN, 1/1 thread resolved, merged 04:54:21Z). `develop` is now `e1c588f` with zero `latest` declarations; merged-tree local gates are lint GREEN, build GREEN, and 76/76 Vitest GREEN. No PR was closed to reach this state.
 
+This turn landed two independent docs-only deltas without force-push or branch deletion: PR #20 added the 9 missing JSDoc comments in `src/policy.ts` (non-test src export docstring coverage 8/17 to 17/17; diff +9/-0; verify `34317973719` GREEN, merged 06:14:43Z), and PR #21 recorded the 2026-09-09 NLIC re-verification that Act No. 21445 still heads `[시행 2026. 9. 11.]` (verify `34318129844` GREEN, merged 06:18:15Z). PR #1 re-verification on current heads shows `verify`, Noema, OpenCode, Semgrep, Trivy, OSV, and Scorecard GREEN, while `strix` flipped to FAIL on a docs-only delta (central logs uninspectable from the leaf repo, routed via the central owner path), `dependency-review` still FAILs despite zero `latest` declarations, and both CodeQL compatibility analyses still FAIL; independent approval remains the structural blocker. A mid-turn edit briefly mangled a traceability header and was repaired before commit, leaving a +4/-0 diff.
+
 ## Current baseline
 
 | Area | Evidence | Status | Commercialization gap | Owner/action | Next verification |
@@ -89,7 +91,7 @@ The successor landed this side chain in `develop` order via PR #18 (successor he
 | Publication | Readiness CTA truthfully does not pretend to publish; immutable `publication_revision` is designed | Planned | No authenticated approval, immutable publication, supersession, rollback, or public URL lifecycle | Review & Publication: implement after persistence/security entry criteria | Authorization, replay/digest, supersession tests |
 | Security/privacy | `docs/SECURITY.md`; local-first runtime; SHA-pinned checkout | Baseline documented | Hosted tenant model, encryption/key handling, audit/incident/retention evidence absent | Platform/Security: threat-model hosted boundary before backend | Exact-head security tests and org scans |
 | Dependency supply chain | Exact-pinned manifest, npm-regenerated lock graph, executable pin/scope/license contracts, and CycloneDX 1.5 CI artifact | Repaired foundation on open stack; exact-head release gate still applies | License compatibility approval and organization vulnerability verdict remain external review responsibilities | PolicyWeave owns direct dependency intent; CI/Security owners retain scanning and release gates | Exact-head clean install, 76 tests, build, SBOM artifact/digest, vulnerability checks, and explicit license review |
-| Tests | 76 unit/UI/schema/workflow/dependency regressions plus PostgreSQL runtime/concurrency/restore scripts, 23 Playwright/axe passes, ten intentional project-scope skips, real-browser interaction/download/error contracts, and screenshot/SBOM artifact contracts | Improved; bounded exact-head verification required after every head movement | Repository-wide 100% execution/docstring coverage is not yet evidenced | Test Engineering: measure coverage and extend realistic edge cases | Exact-head coverage + browser/database/dependency evidence |
+| Tests | 76 unit/UI/schema/workflow/dependency regressions plus PostgreSQL runtime/concurrency/restore scripts, 23 Playwright/axe passes, ten intentional project-scope skips, real-browser interaction/download/error contracts, screenshot/SBOM artifact contracts, and 17/17 non-test src export docstrings | Improved; bounded exact-head verification required after every head movement | Repository-wide 100% execution/branch/boundary coverage is not yet evidenced | Test Engineering: measure coverage and extend realistic edge cases | Exact-head coverage + browser/database/dependency evidence |
 | Performance | Static Vite client | Unevidenced | No realistic buyer-flow browser performance baseline; no network backend exists for meaningful k6 endpoint evidence | Operability: record browser baseline now; add k6 only when hosted network surfaces exist | Real measurements before latency claims |
 | CI/security merge gate | Repo CI plus active organization ruleset-required workflows; immutable Node 24-based checkout, setup/cache, and artifact-upload action releases | Live external gate; warning-free evidence is re-fetched for the exact merge candidate | Every branch movement invalidates predecessor evidence and stale approval; current hosted jobs may remain queued before runner assignment and dependency/reviewer control-plane failures can fail closed independently | Re-fetch exact-head workflows/reviews; use the central owner path for runner/dependency-review incidents rather than leaf-side churn or bypass | Terminal exact-head checks with no action-runtime deprecation warnings + independent approval + resolved threads |