docs(task15): record retained-handle fix evidence

PROJECT_STATE.md

@@ -7,7 +7,7 @@
 > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base
 > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici
 > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato.
-> Last updated: 2026-08-18 (Task 15 fix-round-4 evidence recorded; the authentication feature is
+> Last updated: 2026-08-18 (Task 15 fix-round-5 evidence recorded; the authentication feature is
 > not complete or release-accepted while the required FAIL/PENDING gates listed below remain).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
@@ -16,32 +16,36 @@
 - Task 13 carry-ins are closed with focused TDD: restore acquires the lifecycle lock before
   target-dependent preflight; stages the immutable candidate and recovery archives under that lock;
   accounts their combined capacity before mutation; and uses an opaque installation-bound
-  transaction capability. Fix-round-4 makes `StageArchive` create its streamed, secret-bearing
-  `archive.zip` through a narrow safeio read/write primitive: Unix keeps exact private regular-file
-  behavior and Windows installs an owner-only DACL atomically before any archive bytes are written.
-- Final tested source is `54698e73400a54ce7c3e6c10099e14eb471ce8b9`; prior final Docker source
+  transaction capability. Fix-round-5 makes private archive creation retain its validated parent
+  through the full create/metadata/failure-cleanup sequence: Unix uses `openat` plus descriptor
+  `fchmod`/`fstat` and `unlinkat`; Windows uses NT `RootDirectory`-relative traversal and final
+  create with the owner-only DACL applied in that same operation. StageArchive capacity, lifecycle,
+  rollback, streaming, and cleanup behavior remain covered by its existing tests.
+- Final tested source is `74b062f1a737103524cbe706346cfd65f87cdfd1`; fix-round-4
+  `54698e73400a54ce7c3e6c10099e14eb471ce8b9`, prior final Docker source
   `e20bf33e2a00102192e5be66b178037aeca3a7b1`, fix-round-2
   `fe190e7046acc173f510dddcb32f46ed142858c1`, and follow-up
-  `4d230b87afdcd24f02264f8f937c8628b92db05a` remain intact in history. The final unified Docker
-  smoke is PASS for run `20260818061612-31842-22636`, including maintenance auth isolation,
-  restore, registry lifecycle, rollback, five-image revalidation, and task-scoped cleanup.
+  `4d230b87afdcd24f02264f8f937c8628b92db05a` remain historical provenance. The final unified
+  Docker smoke is PASS for run `20260818070637-66409-30058`, exactly bound to `74b062f...`,
+  including maintenance auth isolation, restore, registry lifecycle, rollback, five-image
+  revalidation, and task-scoped cleanup.
 - PASS on pinned Node `v24.16.0`: provider security fixture 6/6 and current authentication/F1
   Playwright smoke 8/8 with the runtime sentinel used as the exact fixture credential and absent
   from retained output. Round-1 full suites remain PASS: backend 75 files / 1081 tests, frontend
   61 files / 444 tests, harness 921 passed / 4 L2 deselected. The host default Node is `v25.6.1`;
   it is not the release contract and no tracked `v24.19.0` pin exists.
-- PASS: focused native TDD (`safeio` stream, Unix archive privacy, post-write cleanup, immutable
-  staged bytes); full backup/safeio tests; final-source Go race/build across 18 packages; Windows
-  amd64 static test/build cross-compile across 18 packages; Node 24 authentication smoke; shell
-  syntax and unified safety self-tests; default/unified Compose and secret-policy contracts; final
-  unified Docker smoke and cleanup. Windows results are cross-compile only; native execution of the
-  Windows-only `ValidatePrivateRegular` staged-archive test was unavailable and remains PENDING.
+- PASS: focused RED then GREEN Unix ancestor-swap creation test; full backup/safeio tests;
+  final-source Go race/vet/native-host build across 18 packages; Windows amd64 static test/build
+  cross-compile across 18 packages; Node 24 authentication smoke; shell syntax and unified safety
+  self-tests; default/unified Compose and secret-policy contracts; final unified Docker smoke and
+  cleanup. Windows results are compile-only; the native retained-handle
+  `ValidatePrivateRegular` test was not executable on this host and remains PENDING.
 - Durable sanitized evidence is tracked at `.artifacts/task-15/automated-gates.json`
-  (`cce61f6a51ea0a3312e26b7b38a2601512b3e45cd4177d37e60ed7d7ee5cf110`),
+  (`7d9ec93af15510605f1aa7179b26a7ee46d78122f647854300f7a9922057a63f`),
   `.artifacts/task-15/unified-docker-images.json`
-  (`d6845cb3436872ee6a722916f3aa2ad058c5fd66c61333ccad18c0302933361e`), and
+  (`9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`), and
   `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md`
-  (`628bdc6759c12c688d414825eef7b56881d96af1d91577dd9487959e90a9d0bf`). Authentication smoke
+  (`058d4841ec3aa7296ff9ace8aff2efd12303a8e1b1a58d46d4d41941914343a9`). Authentication smoke
   exercised no Docker images; the final unified run retained all five exercised image identities.
 - FAIL baseline evidence remains unchanged: Ruff reports 192 errors; MkDocs strict reports 69
   warnings; canonical/workspace install checks have existing wording mismatches; Pi user-auth