docs: record final P1 integration evidence

PROJECT_STATE.md

@@ -1,41 +1,30 @@
 # ThothII — Project State
 
-> Starting-point snapshot for new sessions. Last updated: 2026-08-09 (final verification).
+> Starting-point snapshot for new sessions. Last updated: 2026-08-10 (final verification).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
-## P1 configuration-process automated integration — PASS 2026-08-09
+## P1 configuration-process automated integration — PASS 2026-08-10
 
-- Retained evidence: `.artifacts/p1-integration/p1-302459009f05b8e7f70e7b43d617aba4/report.md`
+- Retained evidence: `.artifacts/p1-integration/p1-ba92e426576663480bc79bb06c550dde/report.md`
 - automated integration: PASS
 - manual acceptance: PENDING
 - The retained run is bound to clean source commit
-  `d14a99abe7e37778a61a9a510dfdc6a60ef5392d` and tree
-  `2b7607b7e22360a01b8db70fd9b997fc632dc287`. Its hash-bound provenance contains exact
+  `e97f335b881e71c0f1e6820d7998cbab0f2fc851` and tree
+  `5900e987ffd05e33a376c07ff7483942e295796e`. Its hash-bound provenance contains exact
   43-file backend source and 39-file compiled `dist` manifests (manifest SHA-256
-  `f949fb1aaa24a77a8e2f3e41b54d7a7c493189f617a3a854d3dced04d8a5426d` and
+  `eb6d6c77c78d14c798b50d0be430ad124b8fd8965afbc4bb07d358089d23f49` and
   `9f9e8899f8aca882ff08d49ec6cd00caeea75691c8280095a9b88bc74939a30a`).
 - The retained audit has exactly 15 PASS checks and 134 unique declared artifacts whose final
   bytes match every SHA-256 declaration. It records 749 PASS command events and 1,664 production
-  child/network events (831 STARTED, 831 PASS, and the two expected FAIL terminals), with no
-  rejected surface event. Git runs with fixed safe configuration, an owned empty hooks directory,
-  exact local config/attribute/hook validation, and a fail-closed invocation grammar.
-- The public wrapper now clears the entire ambient environment in its fixed kernel shebang before
-  Bash starts. Pre-guard Git calls derive and validate normal, bare, and linked-worktree repository
-  state, reject executable filter/hook/upload-pack configuration before execution, and use one
-  canonical empty fallback hooks directory; guarded production behavior remains independently fixed.
-- The contextual negatives use a separate `invalid-context` branch, remote, checkout, data,
-  runtime, registry, and second production Fastify listener, all beneath the owned run root.
-  Persisted before/after semantic-state proofs show primary `main` remains valid, a missing-tree
-  publish is state-neutral, and an invalid pull advances only its disposable checkout while the
-  remote and last-valid active/snapshot/data/runtime state remain unchanged.
-- The hash-bound final ownership artifact records both production listeners closed with refused
-  connection checks. Independent final probes found both ports refused and PID 80975 dead. The
-  reachable-object scan covered all four expected repositories (156 objects, 48 blobs) with zero
-  fixture-secret findings; the frozen final filesystem scan covered 600 non-fixture regular files,
-  found no symlinks, and found no fixture-secret findings.
-- Final report hashes: `report.json`
-  `b38e3e89a0c205974cca9cde7f0214f8faf2f8bec178a391a80117064e7296ac`;
-  `report.md` `73b604ab8e23da2cbae126fce5260947868c02838c6fa516097568430f39ce14`.
+  child/network events, with listener shutdown and refusal checks recorded in the final ownership
+  artifact. Raw Git rejects configured executable diff drivers and other helper-bearing state.
+- Manual production acceptance now binds the complete compiled distribution manifest before serve;
+  imported dependency replacement is refused before RUNNING publication. Snapshot rendering checks
+  the commit-addressed `snapshot.json` digest and refuses regular source replacement. Manual
+  acceptance remains independently controlled and no `VERDICT.md` is created by automation.
+- Final Task 8/9 focused suites pass (48/48 Task 8; 46/46 lifecycle and 5/5 renderer checks when
+  run serially), backend TypeScript/build pass, frontend tests/build pass. Historical harness
+  pytest/Ruff debt remains unrelated to this P1 work.
 
 ## Internal Qdrant + Ollama semantic infrastructure — LIVE 2026-08-08