docs(auth): record final review fix round 1 evidence

PROJECT_STATE.md

@@ -7,41 +7,39 @@
 > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base
 > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici
 > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato.
-> Last updated: 2026-08-18 (Task 4 recertification recorded; native Windows authority failed and
-> the authentication feature is not implementation- or release-complete).
+> Last updated: 2026-08-18 (final-review fix round 1 recorded; native Windows authentication gate
+> passed, implementation is complete, and unrelated release gates remain open).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
-### Task 4 authentication recertification — FAIL, native Windows CHANGES REQUIRED (2026-08-18)
+### Authentication final-review fix round 1 — implementation PASS, release gates remain (2026-08-18)
 
-- Frozen source under test is `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`.
-  No tracked source changed during certification; only `.playwright-cli/` and `.thothctl/` remain
-  untracked.
-- Local PASS: Go focused security tests for `safeio`, `backup`, and `authstorage`; Go race across
-  18 packages; `go vet`; host build; Windows amd64 cross-compile; Node `v24.16.0` backend
-  `76/1092` and frontend `61/444` with typecheck/build; authentication/F1 smoke and sentinel
-  scan; authentication docs smoke; shell syntax.
-- Local FAIL: harness `951 passed / 1 failed / 4 skipped` (the F4 column-decision test cannot find
-  `workflow.yaml` from its test cwd); Ruff `192` errors; default Compose missing its required
-  workspace-remote variable; unified Compose references absent `compose.unified.yaml`.
-- Authorized workflow run `32122302381` (URL in the Task 4 report) has the exact frozen SHA and
-  conclusion `failure`. Its `Windows clone and Compose contract` job `95665197885` really ran the
-  native `safeio`/`backup` command and failed, including a 10-minute backup lifecycle-lock
-  timeout. The frozen workflow does not request `internal/authstorage`, so that native evidence is
-  absent rather than inferred from cross-compilation.
-- The same run's LF/Compose/docs/TS job failed on an unset `TMPDIR` after its unified Compose
-  contract passed (baseline/CI contract). Its Linux Docker job failed before deployment because
-  `rg` was unavailable; cleanup proof passed and no new image manifest was generated (runner
-  prerequisite). The historical five-image manifest remains bound to source
-  `74b062f1a737103524cbe706346cfd65f87cdfd1` and was not rewritten for this candidate. L2, real
-  PSD/manual acceptance, and provider readiness remain `PENDING` where prerequisites are unavailable.
-- Durable current evidence is tracked in `.artifacts/task-15/automated-gates.json` and
-  `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`; the historical
-  Task 15 report contains a separate Task 4 addendum. Current automated-gates SHA-256 is
-  `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`; the unchanged historical
-  Docker manifest SHA-256 is `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`.
-- **Implementation/release state: NOT COMPLETE.** The three Important findings remain
-  `CHANGES_REQUIRED`; overall release readiness is `FAIL` with additional `PENDING` gates. No
-  source fix was attempted in Task 4.
+- Frozen source is `10cd66fe6a5b484a4dc569326a228c1c5484a5d4` on `feat/thoth-auth`.
+  Source and evidence are separate commits; `.playwright-cli/` and `.thothctl/` remain the only
+  untracked paths.
+- Local PASS on the frozen source: exact `safeio`/`backup`/`authstorage` tests, full Go race suite,
+  `go vet`, macOS host build, Windows amd64 package cross-compiles, and Windows CLI build.
+- Authorized exact-source workflow run `32141428407` completed on the exact frozen SHA and
+  executed the unfiltered native command
+  `go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1`. The required step
+  passed: safeio `8.230s`, backup `5.195s`, authstorage `8.383s`. Native Windows StageArchive and
+  concurrent claim-consume evidence are therefore PASS, not inferred from cross-compilation.
+- The same Windows job later failed the unrelated clone-contract script at
+  `scripts/test-windows-clone-contract.ps1:208` because `$remoteYaml:` is not a valid PowerShell
+  variable reference. LF/Compose and Linux Docker baseline failures also repeated. The optional
+  Windows Docker startup job was skipped without executing and is `NOT_RUN` / `BLOCKED`; the
+  overall completed run conclusion is `failure` because the baseline jobs remain red.
+- Historical Node/auth/browser/docs PASS and harness/Ruff/Compose FAIL evidence remains bound to
+  its recorded source where not rerun. L2, PSD/manual, and provider prerequisites remain
+  `PENDING`; no new Docker image manifest was generated.
+- Durable evidence: `.artifacts/task-15/automated-gates.json`,
+  `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`, and
+  `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-1-report.md`.
+- Current automated-gates SHA-256 is
+  `5c110b7b2607693de078def441b10290c5a29024c83b7e5a0ced894b72b7507f`; the historical Docker
+  manifest remains bound to its recorded older source and was not reused for this candidate.
+- **State:** all four final-review Important findings are addressed and authentication
+  implementation is complete. Overall release readiness remains `FAIL` until the unrelated
+  deployment, Docker-runner, baseline, and external/manual gates are resolved.
 
 ### P3 effective configuration and `.tht-dwh` — implementation complete, automated PASS, manual PASS (2026-08-13)