docs: record public release evidence

FORK_PATCHES.md

@@ -86,8 +86,8 @@ The broader open-source documentation tree and showcase screenshots were added o
 The following release-maintenance files were integrated at `5d0b11f8` and verified in the
 clean detached worktree at DCO-signed candidate
 `712fe36a088bf320d663a857bbd4d1b0eba159e4`. They did **not** exist at product baseline
-`d36f3933`. Because the verification candidate is not pushed or merged to the public default
-branch, they are not evidence that automation is already live:
+`d36f3933`. They were later published through reviewed PR #1; the resolver shell correction
+was published through reviewed PR #2:
 
 | Path | Release-candidate purpose |
 |---|---|
@@ -99,8 +99,9 @@ branch, they are not evidence that automation is already live:
 | `scripts/audit-public-docs.mjs` | Audit public Markdown/HTML links and reject private local paths. |
 | `.github/workflows/ci.yml` | Release-candidate modification that invokes the sync, publishing-guard, and public-doc contracts. |
 
-These paths need a committed default-branch revision and successful GitHub Actions evidence
-before documentation may call the weekly detector operational. See
+Public default-branch run 31493736853 detected `desktop-v0.5.9`, aborted its conflicting
+integration without changing `main`, and opened issue #3. This verifies detection and
+conflict reporting, not a completed upstream upgrade. See
 [`docs/development/fork-and-upgrades.md`](docs/development/fork-and-upgrades.md).
 
 After `712fe36a`, the first full `just ci` run required one formatting-only adjustment to an

docs/evidence/baseline.md

@@ -9,16 +9,17 @@
 | Clean-verification candidate | `712fe36a088bf320d663a857bbd4d1b0eba159e4` | Exact DCO-signed commit verified from a clean detached worktree. Not pushed or tagged. |
 | Full-CI integration candidate | `d57783c5` | DCO-signed integration of the alphabetical `media_tools` module-order fix and full-CI evidence; not pushed or tagged. |
 | Final pre-publication CI candidate | `4e2e785d39126e064f67483f4f2ec95e92dd95f6` | Exact DCO-signed candidate that passed `just ci` after all code, workflow, visual, and upstream-audit work; not pushed or tagged. |
-| Upstream release detector | Local candidate `4e2e785d` | Weekly/manual stable-tag detector and integration-PR preparation; contract passed locally, but workflow is not merged to the public default branch or proven live. |
-| Official upstream main observed during final audit | `f8f2ef0440e7a074223ec04dc3b32d817b8b9d9b` | Context only; not claimed as merged product behavior. Latest stable desktop release remained `desktop-v0.5.8`. |
+| Public product release | `50af5bf26416a602e9562af7e72712f39f8e4174` | Merge of reviewed PR #1 after its 25-check GitHub matrix passed. |
+| Public automation release | `056a82a47f2dd9e35e1a4520ad184fab45897f21` | Merge of reviewed PR #2 after its 23-check GitHub matrix passed. |
+| Upstream release detector | Public `main` at `056a82a4` | Weekly/manual stable-tag detector, reviewed integration preparation, and conflict reporting. Live run 31493736853 detected `desktop-v0.5.9` and safely opened issue #3 after conflicts. |
+| Official upstream main observed during final audit | `f8f2ef0440e7a074223ec04dc3b32d817b8b9d9b` | Historical audit context only; not claimed as merged product behavior. |
 | Fork/upstream-main merge base during audit | `6a17d035f79ad582ca3f4f3cdc38d376f2c4087f` | Divergence reference, not a release baseline. |
 
 At the final audit, public `origin/main` was 27 commits ahead and 30 behind official
 upstream `main`; immediately before this audit-only documentation refresh, the local
 candidate was 36 ahead and 30 behind. The merge base remained `6a17d035`. Moving branch
 names are not durable evidence; always repeat the hashes.
 
-The verification candidates are exact but not publicly reachable. Full CI passes at
-`4e2e785d`; the only following change is this evidence-only documentation update. No
-immutable public documentation/release tag has been verified. A future release must add its
-pushed ref, public clean-clone proof, and tag rather than rewriting this historical record.
+The local verification candidates remain historical evidence. Public release refs and the
+fresh-clone proof are recorded above. No independently signed binary or immutable release
+tag has been published.

docs/evidence/claim-ledger.md

@@ -20,6 +20,6 @@
 | `cargo audit` runs in current CI | Unsupported | No verified workflow step at audit baseline. |
 | Every crate denies all unsafe Rust | Unsupported | Platform-specific unsafe allowances exist. |
 | The fork automatically installs upstream desktop releases | Unsupported | Branch automation detects stable release tags and prepares a reviewed PR; it never auto-merges. |
-| Upstream release detection is currently live | Unverified | Its contract passed at local candidate `4e2e785d`, but the workflow still needs publication and an enabled successful default-branch run. |
+| Upstream release detection is currently live | Verified for detection/conflict path | Default-branch run 31493736853 detected `desktop-v0.5.9`, aborted conflicts safely, and opened issue #3. Clean integration-PR creation remains unobserved. |
 | The detector protects against moved release tags | Implemented in branch contract | Baseline stores tag+SHA and the workflow fails if the recorded tag resolves to another SHA. |
 | Full `just ci` passes | Verified at exact candidate `4e2e785d` | Exit 0 on the final pre-publication source candidate; PostgreSQL, fixture/model, OS-keychain, and release-performance ignored tests remain outside the run. |

docs/evidence/known-issues.md

@@ -19,23 +19,21 @@
 - Generic workflow actions remain incomplete.
 - Optional services require deployment-specific verification.
 - The fork still needs independent identity/signing/update/branding for public binaries.
-- GitHub settings observed on 2026-08-11 had Actions enabled, Issues disabled, and no branch
-  protection on `main`. Source publication must enable Issues and establish reviewed,
-  status-checked branch protection; no setting was changed during the local audit.
-- Clean detached-worktree verification exists for local candidate `712fe36a`, but no pushed
-  public ref, public clean-clone proof, or immutable documentation/release tag exists yet.
-- Full `just ci` passes on the post-`712fe36a` source tree after an ordering-only rustfmt
-  fix, integrated with the evidence at `d57783c5`; no pushed CI run exists yet.
-- Upstream desktop release detection and PR preparation exist in local candidate
-  `712fe36a088bf320d663a857bbd4d1b0eba159e4`. Its static contract passed, but the candidate
-  is not pushed or merged to the public default branch. Scheduled automation remains
-  unproven until published, enabled, and observed in a successful run.
+- Public `main` is protected: pull requests, three stable required checks, stale-review
+  dismissal, conversation resolution, administrator enforcement, and force-push/deletion
+  prevention are enabled. The required approval count is zero so the single-owner fork can
+  merge its own fully checked pull requests.
+- Public source and clean-clone evidence exist, but no independently signed binary or
+  immutable release tag exists yet.
+- The live upstream detector found `desktop-v0.5.9`. Its integration conflicts with the
+  fork, so the workflow aborted without changing `main` and opened issue #3. The fork still
+  inherits `desktop-v0.5.8` until that issue is resolved through a reviewed upgrade PR.
 - Without an `UPSTREAM_SYNC_TOKEN`, the `GITHUB_TOKEN` fallback may prevent the generated
   branch or pull request from triggering every expected recursive CI workflow.
 - A supplied `UPSTREAM_SYNC_TOKEN` also needs Issues write access for the conflict-reporting
   issue path; repository workflow permissions do not add scopes to that separate token.
-- The upstream detector prepares a reviewed integration PR; it deliberately does not
-  auto-merge, resolve conflicts, or certify the resulting release.
+- The upstream detector prepares a reviewed integration PR when the merge is clean; it
+  deliberately does not auto-merge, resolve conflicts, or certify the resulting release.
 
 ## Development warnings
 

docs/evidence/qa-evidence.md

@@ -108,6 +108,30 @@ Desktop Vite build:
 
 Web Vite build reported one output chunk over 500 kB.
 
+## Public release verification
+
+The release was published through reviewed [PR #1](https://github.com/Josh-Gi3r/buzz/pull/1).
+Its final source commit, `56864a163c8ff221caffcf8bc48598bf780ca9e5`, passed all 25 reported
+GitHub checks before merge as `50af5bf26416a602e9562af7e72712f39f8e4174`.
+
+The upstream-sync shell correction was then published through reviewed
+[PR #2](https://github.com/Josh-Gi3r/buzz/pull/2). Its source commit,
+`831ab5f61269e7f3b188b094ddbc94cd9e702a73`, passed all 23 reported GitHub checks before
+merge as `056a82a47f2dd9e35e1a4520ad184fab45897f21`.
+
+A fresh depth-one clone of public `main` at `056a82a4` passed the public documentation
+audit: 76 Markdown files and 142 local links. The clone was clean, contained all five
+showcase PNGs, and reproduced every SHA-256 value in
+[Screenshot provenance](screenshot-provenance.md).
+
+The live default-branch upstream workflow was manually dispatched at
+[run 31493736853](https://github.com/Josh-Gi3r/buzz/actions/runs/31493736853). It resolved
+the newly available `desktop-v0.5.9`, attempted the integration, aborted safely on merge
+conflicts, left `main` unchanged, and created
+[issue #3](https://github.com/Josh-Gi3r/buzz/issues/3). The run concludes failure by design
+when manual integration is required; this proves the conflict-reporting path, not a
+successful upstream merge.
+
 ## Scope and exclusions
 
 The full `just ci` rerun passed, but ignored tests did not execute. This evidence does not
@@ -116,5 +140,5 @@ tests, ignored OS-keychain tests, ignored release-mode performance tests, or oth
 infrastructure-gated paths.
 
 It also does not verify packaging, signing/notarization, installers, update delivery, a live
-deployment, paid/external providers, or desktop E2E beyond the deterministic showcase. No
-public tag or pushed clean-clone verification exists yet.
+deployment, paid/external providers, or a completed `desktop-v0.5.9` integration. No public
+binary or release tag exists yet.

docs/evidence/screenshot-provenance.md

@@ -28,6 +28,6 @@ The hashes also match the earlier repeated `2/2` PM runs, demonstrating determin
 for this mocked E2E story. They do not expand the product truth matrix or verify OpenAI,
 Gemini, Higgsfield, HyperFrames, a live agent, or any external integration.
 
-The final clean detached worktree had an empty status. Candidate `712fe36a` is not pushed or
-publicly tagged; repeat a public clean-clone check after publication before tagging a
-release.
+The final clean detached worktree had an empty status. A fresh clone of public `main` at
+`056a82a47f2dd9e35e1a4520ad184fab45897f21` reproduced all five hashes and passed the
+public documentation audit. No immutable release tag has been published.

docs/reference/evidence-index.md

@@ -19,7 +19,7 @@ Product source is audited at fork `d36f39336b05036f90ba20e273746374c25aaf3e` and
 | ACP/agents | `crates/buzz-acp/`, `crates/buzz-agent/`, desktop managed-agent code | Crate tests and agent desktop E2E. |
 | Projects/git | project features, git/project kinds, relay git modules | Project commit/issue/PR/branch/tag E2E suites. |
 | Workflows | `crates/buzz-workflow/`, relay workflow paths, desktop workflows | `workflows.spec.ts`; executor TODO/placeholder paths constrain status. |
-| Upstream desktop release preparation | `.github/workflows/upstream-desktop-sync.yml`, `.github/upstream-desktop-baseline`, `scripts/latest-upstream-desktop-tag.sh` | `scripts/test-upstream-desktop-sync-contract.sh` statically checks the branch contract; no live default-branch run is claimed. |
+| Upstream desktop release preparation | `.github/workflows/upstream-desktop-sync.yml`, `.github/upstream-desktop-baseline`, `scripts/latest-upstream-desktop-tag.sh` | `scripts/test-upstream-desktop-sync-contract.sh` checks the branch contract and resolver shell syntax. Live run 31493736853 detected `desktop-v0.5.9`, aborted conflicts, and opened issue #3 without changing `main`. |
 | Full local quality gate | Root `Justfile`, component test/build configuration | Exact candidate `4e2e785d` passed `just ci`; exact suite counts and ignored boundaries are in QA evidence. |
 
 ## Preview Studio