docs(auth): record Task 4 certification evidence

.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md

@@ -1,5 +1,35 @@
 # Task 15 retained release-gate report — fix round 5 (sanitized)
 
+## Task 4 recertification addendum — frozen source `b31b27e5845ffd3adf311429367319beaba263c7`
+
+This addendum supersedes the earlier source-bound matrix for current certification while preserving
+the fix-round-5 material below as historical provenance.
+
+- Certification status: `FAIL` / `CHANGES_REQUIRED`; no tracked source changed after the freeze.
+- Native Windows workflow run `32122302381` was dispatched on the exact frozen SHA and concluded
+  `failure`. Job `Windows clone and Compose contract` (`95665197885`) executed the native
+  `safeio`/`backup` test command, which failed; `internal/authstorage` was not part of that frozen
+  workflow command.
+- Local current results: Go focused/race/vet/build and Windows cross-compile PASS; Node 24 backend
+  `76 files / 1092 tests`, frontend `61 files / 444 tests`, typechecks/builds and authentication
+  smoke PASS; harness `951 passed / 1 failed / 4 skipped`, Ruff `192` errors, and Compose contracts
+  FAIL; authentication docs and shell syntax PASS.
+- The same run's `LF, Compose, docs, and TypeScript` job (`95665197839`) failed on an unset `TMPDIR`
+  in the deployment-coupling scope script after its unified Compose contract passed; this is a
+  baseline/CI contract issue. Its Linux Docker job (`95665197846`) stopped before deployment because
+  `rg` was unavailable; cleanup proof passed and no image manifest was generated, so this is an
+  infrastructure prerequisite issue rather than a source-bound Docker result.
+- The remote unified Docker smoke attempt therefore failed before deployment; the existing image
+  manifest below remains historical and is not evidence for the new source.
+- Current machine-readable evidence and the requested Task 4 report are recorded in
+  `.artifacts/task-15/automated-gates.json` and
+  `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`.
+- Current automated-gates SHA-256: `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`.
+- Historical unified Docker manifest SHA-256: `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`.
+
+The complete sanitized Task 4 matrix and the separate remediation/release verdicts are in the
+requested Task 4 report.
+
 - Final tested source commit: `74b062f1a737103524cbe706346cfd65f87cdfd1`.
 - Historical retained source commits: fix-round-2 `fe190e7046acc173f510dddcb32f46ed142858c1`,
   maintenance follow-up `4d230b87afdcd24f02264f8f937c8628b92db05a`, prior final Docker
@@ -7,7 +37,7 @@
   archive privacy `54698e73400a54ce7c3e6c10099e14eb471ce8b9`.
 - Versions: Node contract `v24.16.0`; host default Node `v25.6.1`; Go `go1.26.5`;
   Pi `0.80.3`.
-- Automated gate artifact: `.artifacts/task-15/automated-gates.json`;
+- Historical automated gate artifact: `.artifacts/task-15/automated-gates.json`;
   SHA-256 `7d9ec93af15510605f1aa7179b26a7ee46d78122f647854300f7a9922057a63f`.
 - Docker image manifest: `.artifacts/task-15/unified-docker-images.json`;
   SHA-256 `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`.