docs: maintain durable product-technical gap baseline

[seonghobae]

Scope

Canonical single-writer lane for docs/product-technical-gap-baseline.md. The baseline is a durable commercialization map, not merge authorization: it records protected/released truth and explicit Planned/Active gaps without promoting Draft implementation to shipped capability. Volatile workflow IDs, queue states, mergeability and reviews remain live GitHub truth.

Current authority — 2026-09-22

• Protected truth remains develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.
• This baseline branch remains exact aeacd8deda19f878d802c70b77c65912fb4a6e7e, open · Draft.
• API-01 remains Planned under product/platform(api): establish one deployable Orgmetra product-composition boundary #432. Its durable gap state has not changed, so this lane does not rewrite baseline source merely to enumerate implementation commits.
• Proposed architecture docs(gateway): separate shared edge transport from Orgmetra product composition #433 is now source-current at exact 912fa44ec3b928500acea0291103cb41f6a6d7fc, 42 commits / 3 documentation files. ADR 0432 remains Proposed. Fresh exact-head Foundation/SAST/Security/CodeQL runs were newly queued after material source writes, so predecessor GREEN does not transfer; independent review remains absent.
• Draft feat(composition): admit exact released owner API routes #434 is exact 9ced14ae97f8c07285cdc3975f57a81c717313a2, stacked on fix(ci): run setup-node on Node 24 action runtime #340 exact 28f2bd28414e217f7e848ba86c0cfdbe97fd518f, with 110 commits / 17 files confined to services/product-composition-api/**.

Durable gap states

ASM-01, INT-01, and VAL-01 keep their existing owner paths. API-01 remains Planned through #432, Proposed architecture #433 and bounded executable canary #434. Shared-edge configuration, structural admission, or process-local evidence integrity alone does not close the buyer-visible Gateway gap.

API-01 current interpretation

Protected Architecture/API truth advertises a buyer-facing Orgmetra Gateway while protected executable truth still lacks a supported deployable product-composition boundary.

The durable ownership model remains optional released shared-edge transport plus a separately deployable Orgmetra product-composition application. Composition owns product route admission and request-scoped projection only, not HR truth, Person binding, purpose authorization, owner idempotency/replay/concurrency/error semantics, or scientific truth.

#434 contributes acceptance invariants without changing the Planned gap state: canonical receipt/source binding; owner/upstream/release agreement; one exact owner release per service/generation; constructor/pre-hash/generation/use-time nested-evidence revalidation; process-local owner-release, route, and generation construction integrity without durable-lineage overclaim; deterministic receipt ordering; OpenAPI path-key identity separated from Path Item ownership, deterministic path matching and HTTP operation authority; GET/HEAD selected-resource collision handling; one exact owner release per Path Item; canonical 1..64-character lower-snake-case owner/route/generation identity with an equivalent hyphenated service:// projection; and canonical 1..64 lower-snake-case path-template expressions without empty underscore segments.

Latest construction-integrity evidence is split deliberately:

• OwnerApiRelease: 0637353074d19327940b72821d497ffba131c284 -> 747c2a7a105e3abf23f8ddfbcb5b662f17e61924 -> 6744a55e95073b2c3f8572c62b84e555f580146a;
• CompositionRoute: 5935135daf9eb2a89bcfd32e32105d9bd9563f96 -> 946d0a25faf5759233fb0aabeaf61f2fac653740 -> 9ced14ae97f8c07285cdc3975f57a81c717313a2.

These reject low-level valid-to-valid retargeting of an already-constructed value while allowing legitimately new values to represent new semantics. They remain process-local integrity mechanisms, not durable release/configuration/deployment authority.

This strengthens existing fail-closed exact-evidence semantics but does not change API-01 from Planned and does not make the canary shipped capability; baseline source therefore remains intentionally unchanged.

A separate verification dependency remains explicit: canonical Foundation does not currently discover/execute services/product-composition-api, so repository-level service discovery/runtime acceptance remains #260 after its declared prerequisites. Product-composition has no runtime dependencies and declares Python >=3.11; canonical discovery must eventually execute that truthful support or change it only from owner evidence, not runner convenience.

Shipment still requires released Keyverse/ACL and owner API/operation evidence, durable non-reassignable generation/config/deployment activation authority, canonical Foundation execution of the service, a deployable HTTP composition host, activation/rollback re-admission, fault/security/recovery evidence, supported Kubernetes packaging, and realistic asynchronous [shared edge if deployed] -> composition -> owner HTTP -> PostgreSQL k6/E2E with applicable p95 <=20 ms.

Baseline write rule

Planned/Active work belongs in baseline source when it changes durable buyer/scientific gap state or owner dependency and is explicitly labeled. A Draft PR, local result, ADR or metadata update never becomes Shipped truth merely by being recorded. Conversely, commit churn that does not change durable state stays in owner PR/issue authority rather than repeatedly rewriting this baseline.

This branch remains the only writer for docs/product-technical-gap-baseline.md. Future source currentization must preserve truth-state distinctions, exact owner boundaries, causal stack order, standards-profile scope, canonical identity grammar, process-local evidence integrity versus durable provenance, and fail-closed external-contract semantics.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

제품·기술 격차 기준을 2026-09-16 기준의 durable commercialization baseline으로 재작성했다. 보호된 develop 상태, 상업화 격차, ADR·추적성 상태, 모델 라우팅 및 소유권 정책 검증을 갱신했다.

Changes

제품·기술 격차 기준

Layer / File(s)	Summary
상업화 기준 및 릴리스 게이트 docs/product-technical-gap-baseline.md, docs/doctoring/product-gap-baseline-references.md	제품 테제, truth-state 계약, 도메인 맵, 14개 상업화 격차, 데이터·과학·AI 불변식, 보안·개인정보 기준, 연구 근거와 10개 릴리스 게이트를 추가했다.
보호된 develop 상태 및 추적성 CHANGELOG.md, README.md, docs/TRACEABILITY.md, docs/adr/*, docs/traceability/*	여러 기능과 ADR·추적성 항목의 상태를 active PR 또는 제안 상태에서 보호된 develop 구현·승인 상태로 변경했다. Naruon 통합은 calendar intent 경계로 재정의했다.
정책 경계 및 검증 .gitignore, AGENTS.md, CLAUDE.md, package.json, tests/llm-routing-policy.test.mjs	.codegraph/ 제외 규칙을 추가했다. 모델 기반 Actions의 orchestrator/free 라우팅과 ConceptWeave·semantic-data-portal·contextual-orchestrator의 소유권 경계를 문서화하고 테스트했다.
무결성 메타데이터 갱신 manifest.json	변경된 문서와 package.json의 해시, 바이트 수와 라인 수를 갱신했다.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Other

Merge Risk: 🔵 Low · up to ccfbf

The baseline can still permit inconsistent Talent denominator interpretation and make supporting research evidence harder to reproduce, but these are bounded documentation risks rather than immediate runtime failures.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR 설명과 문서에 #63, #64, #65, #141, #163, #165, #235, #248, #398~#401, #772 등의 관련 이슈와 PR이 명시되어 있습니다.
Out of Scope Changes check	✅ Passed	변경 사항은 baseline 문서화, 저장소 정책, 추적성 상태, ADR 상태, manifest 갱신, 관련 검증 테스트 범위에 있습니다. PR 목적과 무관한 기능 구현은 확인되지 않습니다.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 PR의 주요 변경인 지속 가능한 제품·기술 격차 기준선 문서화를 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/product-technical-gap-baseline

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[seonghobae]

API-01 durable state is unchanged (Planned), so no baseline source rewrite for implementation churn. Current authority: #434 9852fe6bf1b4cddf1b4710d2908cb42019a0ac86; Proposed #433 f6752a124e16c44ad9be053dcb95d1e0c440a496. Add to the durable acceptance set on the next meaningful baseline state currentization: one exact OpenAPI Path Item is bound to one exact OwnerApiRelease in the current bounded profile. Disjoint methods do not make a cross-owner exact-path split admissible because OAS Path Item-level $ref, descriptions, servers, and parameters carry shared semantics and Orgmetra currently has no released merge/conformance contract for them. Preserve this as an acceptance constraint, not a shipped-state change; future broadening requires explicit released shared-field reconciliation evidence.

[seonghobae]

API-01 durable state remains Planned; no baseline source write is justified by this run. #434 advanced to exact b148b34c6330a89669c3eccfad7436a3696a8c7f only to make its package README verification-current: canonical Foundation currently neither triggers for this stacked base nor executes services/product-composition-api in its explicit primary service list. Existing owner #260 now carries the repository-level service discovery/runtime-compatibility handoff. This changes the acceptance dependency graph, not shipped/buyer-visible gap state; keep docs/product-technical-gap-baseline.md source unchanged until its normal durable-state currentization.

[seonghobae]

Volatile implementation authority update only: #434 is now exact c215f282c214caf03bcbb393ac8af8e43f6f09bf (107 commits / 16 files). c215f282... adds only the paired release-version/locator retarget edge contract and positive controls; production behavior remains the owner-construction snapshot introduced at 747c2a7.... API-01 remains Planned, so docs/product-technical-gap-baseline.md source remains intentionally unchanged.

[seonghobae]

API-01 durable-state currentization only; baseline source remains intentionally unchanged. #434 is now exact 9ced14ae97f8c07285cdc3975f57a81c717313a2 (110 commits / 17 files) and adds a process-local CompositionRoute construction snapshot after regression 5935135... showed valid-to-valid route retargeting could otherwise acquire new configuration identity. Causal source is 946d0a25...; README currentization is 9ced14ae....

This strengthens the existing fail-closed canary but does not change API-01 from Planned and does not make route admission a shipped Gateway. The durable baseline distinction should remain: owner-release / route / generation construction snapshots are process-local integrity evidence; production still needs released owner/Keyverse evidence, durable non-reassignable generation/config/deployment authority, a deployable HTTP composition host, recovery/rollback, canonical exact-head execution, and realistic full buyer-path performance evidence. No docs/product-technical-gap-baseline.md source write is warranted for this implementation churn.

[seonghobae]

Baseline authority currentization: #434 advanced test-only to exact be4895e9e86eae1e9f07cd80338e91a05fe148e9 (112 commits / 17 files). 73e5181b... and be4895e9... repair stale regression oracles after the existing route-construction snapshot invariant; production behavior and durable buyer-visible gap state did not change.

Accordingly API-01 remains Planned and docs/product-technical-gap-baseline.md should not be rewritten for this delta. The durable acceptance boundary remains deployable composition + released identity/ACL/owner evidence + durable non-reassignable activation provenance + canonical Foundation execution + recovery/security/performance evidence.

[seonghobae]

API-01 durable state remains Planned; baseline source should not be rewritten for this implementation churn. Fresh owner path now separates process-local admission from durable registry work: #434 exact 68bdf2d984ca7686219c335a85a6574195675cbe; new #435 owns immutable generation/activation authority; Draft #436 exact 80932c808ef873b268217ef1b79b0d14fd8884f7 defines only reconstructable normalized generation records and explicitly does not claim PostgreSQL durability or activation.

A future baseline source write is warranted when #435 changes durable buyer-visible state or dependency ownership—for example when protected/released composition can actually reconstruct/re-admit immutable generation state across restart and activate/rollback it—not merely because the Draft representation contract exists.

[seonghobae]

2026-09-22 API-01 authority currentization only; no baseline source write.

Draft #436 is now exact 04705a05f8e4fd58a39527f56dcb993fd4bb40cb and contains Draft-source PostgreSQL durable generation/configuration persistence: normalized append-only records, exact-material-only idempotent registration, restart reconstruction with canonical digest recomputation, and a real PostgreSQL contract source. This is stronger evidence than the prior persistence-neutral projection but does not change API-01 from Planned.

Buyer-visible closure still requires durable deployment/activation/rollback/recovery authority, deployable HTTP composition, released Keyverse/ACL and owner-operation evidence, canonical exact-head execution/security/review, protected adoption, release evidence and realistic end-to-end performance. Therefore docs/product-technical-gap-baseline.md remains intentionally unchanged on this lane.

[seonghobae]

Baseline handoff: no docs/product-technical-gap-baseline.md source write is warranted. API-01 remains Planned. #436 exact 98b4b129... now closes destructive TRUNCATE on durable generation registry; Draft #437 exact 692d679a... adds structural activation/rollback/recovery plus activation-history TRUNCATE resistance and DeploymentIdentity retarget protection. These are implementation invariants, not a durable buyer-gap state transition to Shipped. Positive production activation still lacks released Keyverse/Orgmetra ACL + fresh owner-operation re-admission binding, canonical Foundation execution, HTTP host, recovery/security and buyer-path evidence.

[seonghobae]

2026-09-22 API-01 currentization only; no baseline source write. Durable state remains Planned because protected/released buyer capability has not changed.

Draft implementation has advanced from process-local #434 into #436 durable generation/configuration and #437 durable activation/re-admission. #437 exact is 60e184fd1edc3e16ee5637929015769cb3e01855, stacked 44 ahead / 0 behind #436 98b4b129073a2afc70f8a533e34c31fdcc15ab07. It now represents transaction-bound evidence persistence/expiry enforcement, refuses product-authorized recovery of structural NULL-evidence history, and removes the structural activation registry from the supported root product API.

These are acceptance-invariant improvements, not a buyer-visible gap-state transition. Keep docs/product-technical-gap-baseline.md unchanged until durable state changes. Shipment still lacks canonical #260 execution, protected exact-head gates/review, actual immutable Orgmetra/Keyverse/owner releases, deployable HTTP composition, and full security/recovery/k6 E2E.

[seonghobae]

API-01 durable gap state remains Planned; no baseline source write is warranted from this run.

Current dependent implementation evidence: #436 remains exact 98b4b129073a2afc70f8a533e34c31fdcc15ab07; #437 advanced ordinary-forward to exact 54a61d0673a2b9702f9c8306473543598c755288 (46 commits / 16 files, 0 behind #436). The fresh repair d480d462... -> 54a61d06... prevents a caller-supplied external evidence provider from valid-to-valid retargeting Orgmetra's reconstructed CompositionGeneration; the local generation is revalidated before the provider and again after provider return.

This strengthens Draft fail-closed authority direction but does not change protected/released buyer capability. #437 still has no canonical PR-triggered workflow run or independent review on its exact head, #433 remains Proposed, #340 CodeQL remains red, and Orgmetra has no published GitHub Release. Keep docs/product-technical-gap-baseline.md unchanged until durable buyer-visible state actually changes.

[seonghobae]

Gap-baseline handoff only; do not change protected baseline state from this comment. Draft #437 advanced to exact 79a109acd91b38f58371eb5f8174dda3e2423009 and now binds external activation evidence to exact action plus durable prior state sequence, with PostgreSQL enforcing the same transition intent after lock acquisition. This closes an implementation-level replay/relabelling defect but does not change buyer-visible completion: API-01 remains Planned because canonical exact-head execution/review, immutable Keyverse/Orgmetra/owner releases, deployable HTTP composition, and full buyer-path p95 evidence are still missing. Keep docs/product-technical-gap-baseline.md single-writer semantics; no source baseline edit is justified by this Draft delta alone.

[seonghobae]

#437 current durable-state handoff: exact head db91f4ff6bd554434f7faaf6b3dd82833d0eda56 now adds current-schema migration 0020 requiring non-NULL durable activation evidence and an executable PostgreSQL contract proving direct unauthorised activation is rejected while evidence-bound activation remains possible.

This is a Draft implementation invariant, not a durable buyer-visible state change. API-01 therefore remains Planned and docs/product-technical-gap-baseline.md source should remain unchanged. Baseline wording should only change when protected/released composition capability or its durable owner dependency state changes; commit-level activation hardening remains in #432/#435/#437 authority.

[seonghobae]

API-01 durable state remains Planned, so no baseline source rewrite is warranted from this run.

Live implementation authority has advanced beyond the body’s older exact heads: #434 is 68bdf2d984ca7686219c335a85a6574195675cbe; #436 is 98b4b129073a2afc70f8a533e34c31fdcc15ab07; #437 is now 2cc217bf07dedb9ebd61bfa95d776b0062b319d6 (61 commits / 21 files). #437 now also rejects valid-to-valid post-construction retargeting of released-authority, owner-observation, and activation-evidence values before durable attribution.

Architecture verification has improved: #433 exact 912fa44ec3b928500acea0291103cb41f6a6d7fc now has Foundation/SAST/Security/CodeQL all terminal success, but still has no submitted review, so ADR 0432 remains Proposed/Draft. #437 itself still has no PR-triggered canonical execution evidence. These changes strengthen Draft evidence but do not make a protected deployable buyer path or shipped capability, so docs/product-technical-gap-baseline.md remains intentionally unchanged.

[seonghobae]

Gap-baseline handoff: #437 advanced to exact ed766da25564fea961e2076882599bac9085f07e with current product-composition schema 0018 -> 0019 -> 0020 -> 0021. Migration 0021 moves owner-operation observation wall-clock validity into durable PostgreSQL authority and refuses impossible future-dated predecessor history.

Buyer-visible completion has not changed: #437 remains Draft without canonical exact-head Foundation/PostgreSQL execution, independent review, released external evidence, deployable HTTP composition host, or end-to-end p95 proof. Keep API-01 Planned; no docs/product-technical-gap-baseline.md source rewrite is warranted from this Draft-only delta.

[seonghobae]

Baseline handoff only; no source rewrite requested from this lane. #437 exact 27b82cc74a60838d57d31aa0a2ed3a131b243b95 now adds durable append-only restart re-admission evidence through migration 0022. This strengthens the Draft implementation but does not change the durable buyer-visible state: API-01 remains Planned because there is still no protected deployable composition application, canonical exact-head execution, real immutable external-release positive path, or buyer-path p95 evidence.

When baseline state eventually changes, preserve the distinction between historical activation evidence and fresh recovery-attestation evidence; do not treat process-local recovery return values or Draft migration existence as Shipped truth.

[seonghobae]

Gap-baseline handoff: #437 moved to exact 03eb4b0861a4f1de07c9b66c20f71ab28d378559 and repaired 0022 schema-publication atomicity. This remains Draft implementation hardening only; no protected deployable buyer path, immutable external production evidence, exact-head canonical execution, or release exists. API-01 should therefore remain Planned and docs/product-technical-gap-baseline.md should not be promoted to Shipped/Active from this delta.

[seonghobae]

Gap-baseline handoff only; no source write requested here. Draft composition hardening advanced #436 to 6ebe5ec... and #437 to c8886e6..., closing unguarded schema-publication windows in migrations 0018 and 0019. Buyer-visible truth has not changed: no protected deployable composition path, released external authority evidence, exact-head canonical execution, full-path p95 acceptance, or immutable Orgmetra release. Keep API-01 Planned and do not promote this Draft movement to Shipped/Active in docs/product-technical-gap-baseline.md.

[seonghobae]

Baseline handoff only; no source write requested from this lane. #437 exact 035826c9ddb1534290d8ed7957da3c5a45b80da4 now includes database-level activation/recovery deployment-row serialization through migration 0023. This is Draft authority hardening and does not change buyer-visible gap state: API-01 remains Planned until protected deployable composition, immutable external authority, canonical execution and end-to-end acceptance exist. Keep docs/product-technical-gap-baseline.md unchanged for this commit churn.

[seonghobae]

Gap-baseline handoff only; no baseline source write requested. Draft #437 is now exact 84d347b5257bbeb876cf7407a4eefd1f25257524 (110 commits / 37 files), with migration 0024 securing trigger-function provenance against migration-session search_path masking and current recovery/serialization PostgreSQL contracts running on that final schema. This does not change durable buyer-visible state: API-01 remains Planned because protected truth still lacks a deployable supported composition host, canonical exact-head execution, real immutable Keyverse/Orgmetra/owner evidence, release provenance, and buyer-path performance acceptance. Preserve the current baseline write rule rather than enumerate Draft implementation churn as shipped capability.

[seonghobae]

API-01 handoff only; no baseline-source write requested. Current Draft composition authority is #436 5fd0087179f2e6f23f2bb3853ad1de397fc53b0e plus #437 468dab6d8be4cdd8467b5093434e4756ce1ce9b0 (111 ahead / 0 behind parent). This run hardened 0018 generation-authority migration provenance against caller-controlled search_path and restacked the activation/recovery child non-force. It did not create a protected deployable HTTP composition path, immutable positive external releases, canonical exact-head PostgreSQL/coverage evidence, buyer-path p95 evidence, or an Orgmetra release. Therefore API-01 remains Planned and docs/product-technical-gap-baseline.md should remain unchanged for this commit-level hardening. #433 also remains Proposed/Draft and its source still needs currentization before architecture admission.

[seonghobae]

Baseline-owner handoff only; no baseline file edit from this lane. #437 exact 960a5fbfcb98075862cdbee8ee094a9b8d7dcc55 closes an ambiguous post-commit recovery-reporting defect by leaving PostgreSQL as commit-time freshness authority and removing a fallible local clock recheck after durable recovery attestation commit. API-01 should remain Planned: protected exact-head execution, immutable real external releases, deployable HTTP composition, and full buyer-path p95 evidence are still absent.

[seonghobae]

API-01 durable gap state remains Planned; no docs/product-technical-gap-baseline.md source write is justified by this Draft-only increment.

Current downstream composition leaf is Draft #446 exact 83f329279dc9e89a75df05c7b76a671cd1cfbd5c, stacked directly on #444 exact e1af671deeeec682dffdf809cb8579dcc4d439da. #446 adds a complete non-streaming response owner above the existing send/event primitive: response-start and terminal-body are prevalidated before the first send; 1xx is excluded from final-response authority; explicit HEAD suppression and 204/205/304 no-content semantics are preserved; explicit Content-Length is now fail-closed against RFC 9110 framing semantics (204 forbids it, 205 can describe only zero content, HEAD/304 and ordinary responses must match the owned representation length, duplicate/invalid values are rejected before transport).

This improves Draft HTTP correctness but does not create a protected deployable composition application, immutable released Keyverse/Orgmetra/owner authority, canonical exact-tree package/PostgreSQL acceptance, authenticated owner dispatch, cleanup/recovery, immutable release, or full buyer-path p95 evidence. Keep the baseline source state Planned and preserve #100 single-writer ownership; volatile exact heads remain live GitHub authority.