docs: record final P1 startup and Git evidence

PROJECT_STATE.md

@@ -1,37 +1,41 @@
 # ThothII — Project State
 
-> Starting-point snapshot for new sessions. Last updated: 2026-08-08 (final verification).
+> Starting-point snapshot for new sessions. Last updated: 2026-08-09 (final verification).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
 ## P1 configuration-process automated integration — PASS 2026-08-09
 
-- Retained evidence: `.artifacts/p1-integration/p1-2f5d861d1151121ad7cc3edb69cf3abb/report.md`
+- Retained evidence: `.artifacts/p1-integration/p1-302459009f05b8e7f70e7b43d617aba4/report.md`
 - automated integration: PASS
 - manual acceptance: PENDING
 - The retained run is bound to clean source commit
-  `0cfe5c7c9a4e6dcd395ec32135b5e4999311432b` and tree
-  `ad6fcfedb2ca1e8d3c16ec632618aaf2e1bbd78f`. Its hash-bound provenance contains exact
+  `d14a99abe7e37778a61a9a510dfdc6a60ef5392d` and tree
+  `2b7607b7e22360a01b8db70fd9b997fc632dc287`. Its hash-bound provenance contains exact
   43-file backend source and 39-file compiled `dist` manifests (manifest SHA-256
-  `2188379320f93f4e24205d418ead9dd25b48ed93da663fcf7e3e6e835931c2bc` and
+  `f949fb1aaa24a77a8e2f3e41b54d7a7c493189f617a3a854d3dced04d8a5426d` and
   `9f9e8899f8aca882ff08d49ec6cd00caeea75691c8280095a9b88bc74939a30a`).
 - The retained audit has exactly 15 PASS checks and 134 unique declared artifacts whose final
   bytes match every SHA-256 declaration. It records 749 PASS command events and 1,664 production
   child/network events (831 STARTED, 831 PASS, and the two expected FAIL terminals), with no
   rejected surface event. Git runs with fixed safe configuration, an owned empty hooks directory,
   exact local config/attribute/hook validation, and a fail-closed invocation grammar.
+- The public wrapper now clears the entire ambient environment in its fixed kernel shebang before
+  Bash starts. Pre-guard Git calls derive and validate normal, bare, and linked-worktree repository
+  state, reject executable filter/hook/upload-pack configuration before execution, and use one
+  canonical empty fallback hooks directory; guarded production behavior remains independently fixed.
 - The contextual negatives use a separate `invalid-context` branch, remote, checkout, data,
   runtime, registry, and second production Fastify listener, all beneath the owned run root.
   Persisted before/after semantic-state proofs show primary `main` remains valid, a missing-tree
   publish is state-neutral, and an invalid pull advances only its disposable checkout while the
   remote and last-valid active/snapshot/data/runtime state remain unchanged.
 - The hash-bound final ownership artifact records both production listeners closed with refused
-  connection checks. Independent final probes found both ports refused and PID 80568 dead. The
+  connection checks. Independent final probes found both ports refused and PID 80975 dead. The
   reachable-object scan covered all four expected repositories (156 objects, 48 blobs) with zero
   fixture-secret findings; the frozen final filesystem scan covered 600 non-fixture regular files,
-  found no symlinks, and found no fixture-secret values.
+  found no symlinks, and found no fixture-secret findings.
 - Final report hashes: `report.json`
-  `268099f89dc203589eae35172b217e88d5f7603281157d78ae9e67ec5f792eda`;
-  `report.md` `f771aaed585c3b628768484338efedb133fae856840d72aa5ba41a675e81816f`.
+  `b38e3e89a0c205974cca9cde7f0214f8faf2f8bec178a391a80117064e7296ac`;
+  `report.md` `73b604ab8e23da2cbae126fce5260947868c02838c6fa516097568430f39ce14`.
 
 ## Internal Qdrant + Ollama semantic infrastructure — LIVE 2026-08-08