docs(state): record Task 15 round-one evidence

PROJECT_STATE.md

@@ -7,7 +7,7 @@
 > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base
 > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici
 > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato.
-> Last updated: 2026-08-18 (Task 15 automated evidence recorded; the authentication feature is
+> Last updated: 2026-08-18 (Task 15 fix-round-1 evidence recorded; the authentication feature is
 > not complete or release-accepted while the required FAIL/PENDING gates listed below remain).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
@@ -18,10 +18,22 @@
   an opaque installation-bound transaction capability. Focused mutation/concurrency/lock-leak
   tests and the full Go race/build gate pass.
 - PASS on the pinned Node `v24.16.0`: backend 75 files / 1081 tests plus typecheck/build; frontend
-  61 files / 444 tests plus typecheck/build and 6 Playwright tests; hermetic loopback OIDC browser
-  smoke; harness 921 passed / 4 L2 deselected; authentication-documentation smoke; unified Docker
-  smoke with scoped cleanup; installer shell test; relevant Compose/security contracts. The default
-  host Node is `v25.6.1`; it is not the release contract and no tracked `v24.19.0` pin exists.
+  61 files / 444 tests plus typecheck/build and current Playwright 8/8 (7 authentication + 1 shared
+  F1); hermetic authentication smoke; round-1 provider security fixture 6/6; harness 921 passed /
+  4 L2 deselected; authentication-documentation smoke; installer shell test; relevant
+  Compose/security contracts. The default host Node is `v25.6.1`; it is not the release contract
+  and no tracked `v24.19.0` pin exists.
+- Task15 fix-round-1 source commits are `2b618c5a0f6f07045700cfe7146ca517fb5f78ab`
+  (provider/E2E) and `b2772f10a5729bf08bbd1f3dc6abc0cee1eb5043` (failed-run image
+  retention). The current unified Docker smoke is **FAIL**, reproduced twice at
+  `workspace_maintenance_auth_isolation`; both runs completed scoped cleanup. Docker image
+  traceability is PASS for the retained failed run: all 4 images exercised before that checkpoint
+  were inspected and revalidated before cleanup. Authentication smoke exercised no Docker image.
+- Sanitized evidence digests: `.artifacts/task-15/automated-gates.json`
+  `aa50c17880d6fff5af74f985aed888fce0d0d1a4608e9da241e1c1c1deb2d19c`;
+  `.artifacts/task-15/unified-docker-images.json`
+  `525d269b72995e41358b29bcd33704f6b04ff35b99b9f2cfa40c03be8664f9f6`; ignored Task15 report
+  `8b67b9a3bd7b55a7ad74fcc560f0cd8dac5667588568ed3428ad5125f1e0071a`.
 - Task15 fixture regressions in preprocess, server Pi-state, and Pi-auth Compose contracts were
   repaired and their focused checks pass. Static Windows amd64 cross-build and test compilation
   pass for 18 Go packages.