docs: record issue 48 integration evidence

docs/BUILD_LOG.md

@@ -7,6 +7,29 @@ Branch and phase statements remain true only for the commit named in their entry
 Use [`TASKS.md`](TASKS.md) for the current repository snapshot, defects,
 pending checks, and workflow.
 
+## 2026-08-31 — STABILITY protected-main integration closeout
+
+Issue [#48](https://github.com/kyashp/shepherd/issues/48) implementation and
+evidence [PR #93](https://github.com/kyashp/shepherd/pull/93) merged to protected
+`main` as `b05a4aad10d0c4c0e9f7d54fed2cdd5c779c16b0`. Its parents are the
+frozen integrated base `a2a464d6be697ab949b254944b81c355a9be5403` and final
+evidence head `ec015b6414b56df297a83489004edae441243483`; `git diff` between
+the merge tree and that second parent is empty.
+
+A fresh detached worktree whose HEAD and `origin/main` were both exact `b05a4aa`
+ran one literal `npm run check` with no environment, worker, timeout, or retry
+override. It exited 0: all four production/test-source typechecks passed;
+launcher/deploy passed 12/12; Server passed 846 with three unchanged documented
+opt-in skips in 140.70s; Web passed 20/20; and both production builds passed. No
+warning, live/model request, product/UI mutation, or tracked-file change occurred.
+
+The merge-triggered protected-main workflow run
+[`33353622211`](https://github.com/kyashp/shepherd/actions/runs/33353622211)
+also completed successfully on exact `b05a4aa`; its `Node 22 / npm run check`
+job ran for 3m40s. Together with the immutable five-run candidate campaign at
+`10c95da`, this establishes both issue gates `C` and `I`. This is an integration
+verification record, not a claim of a separate independent audit.
+
 ## 2026-08-31 — STABILITY candidate passed five consecutive literal gates
 
 Issue [#48](https://github.com/kyashp/shepherd/issues/48), draft

docs/FIXES.md

@@ -40,12 +40,14 @@ that limitation is explicit.
   recovery path. Concurrent first-use candidates can therefore race private-root
   sentinel adoption and fail before `runner.run` registers their private homes as
   cleanup-fault targets. The row then measures setup adoption instead of cleanup.
-- **Correction/status:** **RESOLVED CANDIDATE** at `69d82b4` on PR #93. Call the
+- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa`
+  via PR #93; causal correction `69d82b4`. Call the
   public executor preflight once and assert it occurred before candidate scheduling;
   cleanup injection, timeout, and failure/no-promotion assertions are unchanged.
   The exact row passed 10/10, executor file 72/72, full Server 845/3 skipped before
   rebase, and the formal current-main campaign passed five literal gates at
-  `10c95da`. Integration audit remains pending.
+  `10c95da`. Exact-main local check passed Server 846/3 skipped plus all adjacent
+  gates, and protected-main workflow `33353622211` passed. Not independently audited.
 
 ### `TST-29` — PERF-01 overlap proof spends its budget on full Mission setup
 
@@ -56,13 +58,15 @@ that limitation is explicit.
   five-second row builds a complete Git-backed Mission before reaching that
   boundary. Under suite pressure the setup consumes the timing budget even when
   candidate scheduling is correct.
-- **Correction/status:** **RESOLVED CANDIDATE** at `f3a9dc0` on PR #93. Move the
+- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa`
+  via PR #93; causal correction `f3a9dc0`. Move the
   existing byte-equivalent `allSettledBounded` primitive to the canonical scheduler
   module and prove two-start-before-release, completion-after-release, limit-one,
   rejection, and input-order behavior directly. Adjacent 30-second real-Plane tests
   retain completed-Mission, selection, promotion, and `promotion_completed`
   coverage. No product timeout/concurrency/retry changed. Formal campaign 5/5 at
-  `10c95da`; integration audit remains pending.
+  `10c95da`; exact-main local check passed Server 846/3 skipped plus all adjacent
+  gates, and protected-main workflow `33353622211` passed. Not independently audited.
 
 ### `TST-28` — F-03 snapshot cleanup is observed through OS file watchers
 
@@ -72,13 +76,16 @@ that limitation is explicit.
   service-owned lifecycle boundary. Under full-suite contention it can miss the
   removal or contribute descriptor pressure even though the snapshot owner's
   `finally` is correct.
-- **Correction/status:** **RESOLVED CANDIDATE** at `682d7d9` on PR #93. The existing
+- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa`
+  via PR #93; causal correction `682d7d9`. The existing
   optional fault-checkpoint seam emits one exact
   `contract_verification_snapshot_removed` checkpoint only after owned cleanup
   settles; both F-03 variants await the matching Mission/Contract checkpoint and
   still require `lstat -> ENOENT`. A failing observer cannot mask the primary
   verifier error. Both rows passed five consecutive focused repetitions and the
-  formal campaign passed 5/5 at `10c95da`; integration audit remains pending.
+  formal campaign passed 5/5 at `10c95da`. Exact-main local check passed Server
+  846/3 skipped plus all adjacent gates, and protected-main workflow `33353622211`
+  passed. Not independently audited.
 
 ### `TST-27` — Fixture Git inherits outer repository selector variables
 
@@ -88,12 +95,15 @@ that limitation is explicit.
 - **Failure contract:** `git -C` does not override explicit repository selectors.
   Raw `execFile("git", ...)` inherited the enclosing hook/session environment, so
   a nested test could mutate the wrong index before asserting its repository.
-- **Correction/status:** **RESOLVED CANDIDATE** at `682d7d9` on PR #93. Fixture Git
+- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa`
+  via PR #93; causal correction `682d7d9`. Fixture Git
   receives only PATH plus fixed locale/noninteractive/no-config values, never ambient
   selector variables, and destructive fixture setup first proves the selected
   repository's real top level. The hostile-selector/decoy regression passed, the
   normal pre-push gate no longer redirected staging, and the formal campaign passed
-  5/5 at `10c95da`. Integration audit remains pending.
+  5/5 at `10c95da`. Exact-main local check passed Server 846/3 skipped plus all
+  adjacent gates, and protected-main workflow `33353622211` passed. Not independently
+  audited.
 
 ### `CRUD-01` — Clarification drafts permanently block Agent deletion
 

docs/TASKS.md

@@ -270,7 +270,7 @@ without an open issue/PR are not active ownership claims.
 | `TEST-TS` | 16 Phase 9B | **AUDITED** at integrated implementation `8995605` | Separate strict no-emit server test-source config is enforced by root `typecheck`/`check`; production emit config is unchanged. RED evidence covers 14 errors across 4 test files (4 implicit callback types, 5 invalid Vitest matcher generics, 4 stale promotion fixtures, 1 stale verifier fixture), then 2 nullable fixture values exposed after matcher typing was restored. Auditor confirmed no suppression, broad exclusion, compiler weakening, blanket `any`, assertion weakening, product/UI change, or dependency churn. Candidate and integrated strict test-source checks passed; both production typechecks/builds passed; affected suites passed 73/73; literal candidate and integrated gates passed with launcher 3/3, server 563/563 and one unchanged opt-in live skip, plus both production builds. | **100% scoped**; `T,C,I` passed (3/3); audited |
 | `CI-01` | 0.1, 16, 17 | **AUDITED** at workflow `cda2446`; hosted run `33259565232` succeeded | `required-checks.yml` uses supported official checkout/setup-node actions, Node 22, lockfile-backed npm cache, `npm ci`, Docker availability, and literal `npm run check`; it triggers every PR, pushes to protected `main`, and merge-queue `checks_requested`. Token permission is only `contents: read`; checkout credentials are not persisted; no `.env`, secrets, artifacts, privileged actions, or live/model path is configured. Independent local validation passed Docker 29.7.2 and launcher 3/3 plus server 555/555 with one opt-in skip. Hosted Node 22.23.2/npm 10.9.8 and Docker client/server 28.0.4 passed locked install, launcher 3/3, server 551 passed/5 environment-gated skips, typechecks, 40-module web build and server build. Stable job check: `Node 22 / npm run check`. Administrator must require that check on protected `main`; this external rule change is not performed by agents. `C,I`. | **100% scoped**; `C,I` passed (2/2); audited |
 | `SEC-REVIEW` | 0.3, 13, 17 | `PARTIAL`; parts 4-5 tracked in [issue #89](https://github.com/kyashp/shepherd/issues/89), successor to [#49](https://github.com/kyashp/shepherd/issues/49) | Parts 1-3 are evidenced at `bd9b093`. **Canary scan:** exactly two credentials exist, both threaded as `sensitiveValues`; no path found by which either reaches `state.json`, a model prompt, a 4xx/5xx body, the DOM, browser storage, a URL, the logger or a tracked file. The Ark key is never in argv and never in the generated Codex config. Two low observations: `/api/system` has no redaction pass, and `ARK_API_KEY` has no minimum length against a 4-character redaction floor. **Five invariant mutations, each caught by an existing test:** bearer auth rejection (2 tests), promotion refusal on failed final re-verification (`failure-matrix`), fast-forward-only protected-ref CAS, contract-cannot-broaden-authority intersection, and verifier Plane containment. **Boundary audit: FAIL.** Route inventory, traversal, identity, authority and promotion boundaries hold, but the bearer hook was bypassable by percent-encoding the `/api/` prefix — filed and fixed as `SEC-01`. **Parts 4 and 5 are tracked in [#89](https://github.com/kyashp/shepherd/issues/89), successor to `#49` after that issue was closed three times with its scope unsatisfied:** the independent read-only review must not be done by the author of `config.ts`'s token floor, `check-deploy-auth-token.mjs`, the deploy guard, the `A`-gate tests or the `SEC-01` fix. This row also owns the carried `OPS-06` High finding: `docker-compose.yml` binds `0.0.0.0` with an unprefixed port while `README` documents two entry points a deploy-script guard cannot reach. `C,S,I`. | **85%**; parts 1-3 evidenced; a seven-lens adversarial review ran for part 4 and returned 19 confirmed findings with 0 refuted, of which five Highs are fixed; part 5 incomplete and four findings remain open; whether that review satisfies "by someone other than the author" is the maintainer's call; not audited |
-| `STABILITY` | 16 Phase 9B | **REVIEWED CANDIDATE** at `10c95da` on draft [PR #93](https://github.com/kyashp/shepherd/pull/93), [issue #48](https://github.com/kyashp/shepherd/issues/48); integrated feature-freeze base `a2a464d` | The first `bd77952` sequence was truthfully reset after run 4 exposed PERF-01's full-Mission timing harness. Four causal corrections now isolate inherited Git selectors, post-cleanup F-03 observation, scheduler overlap, and candidate-cleanup preflight without sleeps, timeout/retry increases, hidden workers, suppression, skips, or weakened assertions. On immutable candidate `10c95da`, five separate literal `npm run check` gates passed: launcher/deploy 12/12, Server 846 passed / 3 documented skips, Web 20/20, all typechecks and both builds on every run; Server durations were 149.16, 145.77, 144.00, 145.19, and 137.87 seconds. Required hosted runs `33351880563` and `33351880571` also passed. `C,I`. | **90% scoped**; candidate `C` passed (1/2); integrator review/merge and protected-main `I` rerun pending; not audited |
+| `STABILITY` | 16 Phase 9B | **INTEGRATED** at protected-main merge `b05a4aa` via [PR #93](https://github.com/kyashp/shepherd/pull/93), [issue #48](https://github.com/kyashp/shepherd/issues/48); immutable campaign candidate `10c95da` | The first `bd77952` sequence was truthfully reset after run 4 exposed PERF-01's full-Mission timing harness. Four causal corrections isolate inherited Git selectors, post-cleanup F-03 observation, scheduler overlap, and candidate-cleanup preflight without sleeps, timeout/retry increases, hidden workers, suppression, skips, or weakened assertions. Candidate `10c95da` passed five separate literal `npm run check` gates: launcher/deploy 12/12, Server 846 passed / 3 documented skips, Web 20/20, all typechecks and both builds on every run; Server durations were 149.16, 145.77, 144.00, 145.19, and 137.87 seconds. A fresh literal exact-main check at `b05a4aa` passed the same counts with Server duration 140.70s; protected-main workflow `33353622211` also passed. `C,I`. | **100% scoped**; `C,I` passed (2/2); integration verified, not independently audited |
 | `LIVE-01` | 16 Phase 3/7/8 | `BLOCKED` by host capability, not by code; [issue #65](https://github.com/kyashp/shepherd/issues/65), split out of #47 | Reviewer sub-gate is satisfied: command attempt two made exactly one external request and completed with two bounded findings while deterministic outcome/security/cleanup stayed green. Current live Shepherd Mission and legacy continuity remain required. Reproduced on the affected host at `b80af11`: a plain write to a host-share bind mount inside the Runtime succeeds while the identical write under `codex sandbox linux --full-auto` is denied, so `test:shepherd:live` — which pins `CONTAINER_STATE_ROOT`/`CONTAINER_STATE_VOLUME` to `undefined` and bind-mounts `.tmp/shepherd-live-gate` — would fail at `stage=container_start reason=sandbox_probe_failed` and consume the no-retry allowance for no evidence. The gate needs a Linux host, or a code change making it volume-aware, which is outside an `L` run. `L,S,I`. | **55%**; 1/3; not audited |
 | `DEMO-REHEARSAL` | 14–15, 16 Phase 8 | `BLOCKED` by all demo-critical rows; [issue #50](https://github.com/kyashp/shepherd/issues/50) | Three clean reset-to-completion judge flows under three minutes, including clean no-op reset and initialized reset; second machine/state if genuinely available. `B,S,I`. | **0%**; 0/3; not audited |