docs(state): correct Task 15 source provenance

.artifacts/task-15/automated-gates.json

@@ -4,7 +4,7 @@
   "source_commits": {
     "authentication_round1": "2b618c5a0f6f07045700cfe7146ca517fb5f78ab",
     "fix_round2": "fe190e7046acc173f510dddcb32f46ed142858c1",
-    "maintenance_profile_follow_up": "4d230b840f99f33005a7c66566c16c48177e990b",
+    "maintenance_profile_follow_up": "4d230b87afdcd24f02264f8f937c8628b92db05a",
     "fix_round3_and_final_docker": "e20bf33e2a00102192e5be66b178037aeca3a7b1"
   },
   "versions": {

.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md

@@ -2,11 +2,11 @@
 
 - Final tested source commit: `e20bf33e2a00102192e5be66b178037aeca3a7b1`.
 - Fix-round-2 commits retained unchanged: `fe190e7046acc173f510dddcb32f46ed142858c1`
-  and follow-up `4d230b840f99f33005a7c66566c16c48177e990b`.
+  and follow-up `4d230b87afdcd24f02264f8f937c8628b92db05a`.
 - Versions: Node contract `v24.16.0`; host default Node `v25.6.1`; Go `go1.26.5`;
   Pi `0.80.3`.
 - Automated gate artifact: `.artifacts/task-15/automated-gates.json`;
-  SHA-256 `73c5c4f2b497aeda114e725f718f1e542a4c05691bd9257b6e607e55b1d02236`.
+  SHA-256 `af835ab5eb37951881cc526a9576eb5789af510e0e4f2806d4d8ed080fb70fba`.
 - Docker image manifest: `.artifacts/task-15/unified-docker-images.json`;
   SHA-256 `835790fbff5980c494c32f4473b46675ce7d568e7e6e39e30000ff0400b4dbb7`.
 

PROJECT_STATE.md

@@ -20,7 +20,7 @@
   Unix and Windows rather than POSIX-mode assumptions.
 - Final tested source is `e20bf33e2a00102192e5be66b178037aeca3a7b1`; fix-round-2 commits
   `fe190e7046acc173f510dddcb32f46ed142858c1` and follow-up
-  `4d230b840f99f33005a7c66566c16c48177e990b` remain intact in history. The final unified Docker
+  `4d230b87afdcd24f02264f8f937c8628b92db05a` remain intact in history. The final unified Docker
   smoke is PASS for run `20260818054002-16619-2452`, including maintenance auth isolation,
   restore, registry lifecycle, rollback, five-image revalidation, and task-scoped cleanup.
 - PASS on pinned Node `v24.16.0`: provider security fixture 6/6 and current authentication/F1
@@ -33,11 +33,11 @@
   default/unified Compose and secret-policy contracts; final unified Docker smoke and cleanup.
   Native execution of the Windows-only owner-DACL test was unavailable and remains PENDING.
 - Durable sanitized evidence is tracked at `.artifacts/task-15/automated-gates.json`
-  (`73c5c4f2b497aeda114e725f718f1e542a4c05691bd9257b6e607e55b1d02236`),
+  (`af835ab5eb37951881cc526a9576eb5789af510e0e4f2806d4d8ed080fb70fba`),
   `.artifacts/task-15/unified-docker-images.json`
   (`835790fbff5980c494c32f4473b46675ce7d568e7e6e39e30000ff0400b4dbb7`), and
   `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md`
-  (`4d086bbecf4f20edd6df76a92909fc15b04996a1b2409e7d6ffef07c98684086`). Authentication smoke
+  (`ba4da7f5bfb445ffb0fcca4d0620786e001c4b892efae22b26cbb33b194c6a86`). Authentication smoke
   exercised no Docker images; the final unified run retained all five exercised image identities.
 - FAIL baseline evidence remains unchanged: Ruff reports 192 errors; MkDocs strict reports 69
   warnings; canonical/workspace install checks have existing wording mismatches; Pi user-auth