fix: close P1 acceptance audit gaps

PROJECT_STATE.md

@@ -5,7 +5,7 @@
 
 ## P1 configuration-process automated integration — PASS 2026-08-09
 
-- Retained evidence: `.artifacts/p1-integration/p1-f9327d6f41dafbd8a8cd8f6c9efc0276/report.md`
+- Retained evidence: `.artifacts/p1-integration/p1-70727c7802050c76978d5007a634ede1/report.md`
 - automated integration: PASS
 - manual acceptance: PENDING
 - The contextual negatives use a separate `invalid-context` branch, remote, checkout, data,
@@ -13,10 +13,15 @@
   Persisted before/after semantic-state proofs show primary `main` remains valid, a missing-tree
   publish is state-neutral, and an invalid pull advances only its disposable checkout while the
   remote and last-valid active/snapshot/data/runtime state remain unchanged.
-- The retained audit hashes every request/response and descriptor/negative fixture, production
-  Git Trace2 plus runner command events, and all declared artifacts with unique paths. The final
-  whole-run, reachable-Git, and virtual-report scan found no fixture canaries outside the excluded
-  secret fixture directory.
+- The retained audit has 132 unique declared artifacts whose final bytes match every SHA-256
+  declaration. It records canonical Git, Python lock-holder, and `tht` children under bounded
+  process/environment policy, both production listeners closed, and no rejected child/network
+  surface events. The in-capture reachable-object scan covered all four expected repositories
+  (156 objects, 48 blobs) with zero findings; the frozen final filesystem and virtual-report scan
+  also found no fixture canaries outside the excluded secret fixture directory.
+- Final report hashes: `report.json`
+  `61d767ea90ad1055a1f6fdadec551752b36f44ca173959c33f470c57a4c706a2`;
+  `report.md` `dbbb37f47f5d686bde3a3516ff7fb3d06c8835aa3b72167f1984436c330446ef`.
 
 ## Internal Qdrant + Ollama semantic infrastructure — LIVE 2026-08-08