docs: record boundary-contract turn and PR1 tracking state

docs/product-technical-gap-baseline.md

@@ -77,6 +77,8 @@ The successor landed this side chain in `develop` order via PR #18 (successor he
 
 This turn landed two independent docs-only deltas without force-push or branch deletion: PR #20 added the 9 missing JSDoc comments in `src/policy.ts` (non-test src export docstring coverage 8/17 to 17/17; diff +9/-0; verify `34317973719` GREEN, merged 06:14:43Z), and PR #21 recorded the 2026-09-09 NLIC re-verification that Act No. 21445 still heads `[시행 2026. 9. 11.]` (verify `34318129844` GREEN, merged 06:18:15Z). PR #1 re-verification on current heads shows `verify`, Noema, OpenCode, Semgrep, Trivy, OSV, and Scorecard GREEN, while `strix` flipped to FAIL on a docs-only delta (central logs uninspectable from the leaf repo, routed via the central owner path), `dependency-review` still FAILs despite zero `latest` declarations, and both CodeQL compatibility analyses still FAIL; independent approval remains the structural blocker. A mid-turn edit briefly mangled a traceability header and was repaired before commit, leaving a +4/-0 diff.
 
+This turn added boundary evidence without production change: PR #23 (`src/policy-boundary.test.ts`, +48/-0) pins 6 edge contracts that all passed on first run — uppercase service-URL canonicalization, username-only URL rejection without username leakage, contradiction-plus-blocker counting, step 2/3 exclusion under contradiction, a 4-case email-format matrix, and null export of a whitespace retention period. Suite stands at 82/82 with 17/17 non-test src export docstrings; verify `34320952183` GREEN, merged 06:54:20Z. PR #1 tracking: on head `2d4928d`, `verify` stayed GREEN while `dependency-review` and both CodeQL compatibility analyses still FAIL; `strix` showed one FAIL on `632a08e` then a pending rerun, so its verdict on that head is inconclusive rather than confirmed. The PR #23 merge advanced `develop` to `82e7826`, re-queuing the full central matrix; that verdict is pending and is not claimed here.
+
 ## Current baseline
 
 | Area | Evidence | Status | Commercialization gap | Owner/action | Next verification |
@@ -91,7 +93,7 @@ This turn landed two independent docs-only deltas without force-push or branch d
 | Publication | Readiness CTA truthfully does not pretend to publish; immutable `publication_revision` is designed | Planned | No authenticated approval, immutable publication, supersession, rollback, or public URL lifecycle | Review & Publication: implement after persistence/security entry criteria | Authorization, replay/digest, supersession tests |
 | Security/privacy | `docs/SECURITY.md`; local-first runtime; SHA-pinned checkout | Baseline documented | Hosted tenant model, encryption/key handling, audit/incident/retention evidence absent | Platform/Security: threat-model hosted boundary before backend | Exact-head security tests and org scans |
 | Dependency supply chain | Exact-pinned manifest, npm-regenerated lock graph, executable pin/scope/license contracts, and CycloneDX 1.5 CI artifact | Repaired foundation on open stack; exact-head release gate still applies | License compatibility approval and organization vulnerability verdict remain external review responsibilities | PolicyWeave owns direct dependency intent; CI/Security owners retain scanning and release gates | Exact-head clean install, 76 tests, build, SBOM artifact/digest, vulnerability checks, and explicit license review |
-| Tests | 76 unit/UI/schema/workflow/dependency regressions plus PostgreSQL runtime/concurrency/restore scripts, 23 Playwright/axe passes, ten intentional project-scope skips, real-browser interaction/download/error contracts, screenshot/SBOM artifact contracts, and 17/17 non-test src export docstrings | Improved; bounded exact-head verification required after every head movement | Repository-wide 100% execution/branch/boundary coverage is not yet evidenced | Test Engineering: measure coverage and extend realistic edge cases | Exact-head coverage + browser/database/dependency evidence |
+| Tests | 82 unit/UI/schema/workflow/dependency/boundary regressions plus PostgreSQL runtime/concurrency/restore scripts, 23 Playwright/axe passes, ten intentional project-scope skips, real-browser interaction/download/error contracts, screenshot/SBOM artifact contracts, and 17/17 non-test src export docstrings | Improved; bounded exact-head verification required after every head movement | Repository-wide 100% execution/branch/boundary coverage is not yet evidenced | Test Engineering: measure coverage and extend realistic edge cases | Exact-head coverage + browser/database/dependency evidence |
 | Performance | Static Vite client | Unevidenced | No realistic buyer-flow browser performance baseline; no network backend exists for meaningful k6 endpoint evidence | Operability: record browser baseline now; add k6 only when hosted network surfaces exist | Real measurements before latency claims |
 | CI/security merge gate | Repo CI plus active organization ruleset-required workflows; immutable Node 24-based checkout, setup/cache, and artifact-upload action releases | Live external gate; warning-free evidence is re-fetched for the exact merge candidate | Every branch movement invalidates predecessor evidence and stale approval; current hosted jobs may remain queued before runner assignment and dependency/reviewer control-plane failures can fail closed independently | Re-fetch exact-head workflows/reviews; use the central owner path for runner/dependency-review incidents rather than leaf-side churn or bypass | Terminal exact-head checks with no action-runtime deprecation warnings + independent approval + resolved threads |