@@ -606,7 +606,9 @@ jobs:
       # same three-platform command the module README documents (re-run
       # 2026-09-05: no lock rewrite). Three provider zips (~0.7 GB) plus
       # terraform init is why this job's timeout-minutes is 20, not 10.
-      # It has not been observed on a GitHub runner until the owner pushes.
+      # Observed green on ubuntu-latest 2026-09-08 (run 34213482386): the step
+      # regenerates all three platforms and the diff comes back empty, so the
+      # tracked lock genuinely covers the runner it is used on.
       - name: Provider lock covers linux_amd64
         run: |
           cd infrastructure/terraform
@@ -619,8 +621,11 @@ jobs:
     # only in publish-npm.yml (tag pushes) and mutation.yml; every PR only got
     # `npm audit` (security.yml). This job gives PRs the same build-shaped
     # gate the publish workflow already trusts, so a broken SDK cannot merge.
-    # Branch protection required-context wiring is a repo-settings change the
-    # owner still has to make (gh api repos/{owner}/{repo}/branches/main/protection).
+    # `sdk-ts` is one of the 15 required status checks on `main` (confirmed
+    # 2026-09-08 via gh api repos/{owner}/{repo}/branches/main/protection), so
+    # renaming this job silently removes a gate: the context stops reporting,
+    # and a required check that never reports blocks merges instead of failing
+    # them. Rename here and in branch protection together, or not at all.
     runs-on: ubuntu-latest
     timeout-minutes: 15
     defaults:
 
@@ -4,6 +4,26 @@ All notable changes to AgentFlow are documented in this file.
 
 ## [Unreleased]
 
+### Docs — the pre-push hedges outlived the push
+
+* **Several notes described work the owner "still has to do" that has since
+  been done**, and a hedge that has stopped being true reads as a live task.
+  The provider-lock guard in `terraform-validate` was annotated "has not been
+  observed on a GitHub runner"; it has, on `ubuntu-latest`, regenerating all
+  three platforms to an empty diff. `ASSUMPTION-T-36-CI-LOCK` in the OIDC
+  runbook is marked discharged with that evidence, and narrowed to what is
+  still genuinely unobserved: the macOS and Windows entries are regenerated
+  identically, never actually consumed, because CI has no runner on either.
+* **`sdk-ts` is a required status check now**, not a wiring change waiting to
+  happen, so the comment above the job says what that costs: renaming the job
+  silently removes a gate, because a required context that never reports blocks
+  merges rather than failing them. Rename it and branch protection together.
+* **Two closure documents called a pushed evidence commit local-only.**
+  `cf247ba` has been in `origin/main` since the 2026-09-08 push;
+  `PROJECT_CLOSURE.md` and `release-readiness.md` say so now. Dated evidence
+  records under `docs/evidence/` and `docs/perf/` keep their original wording —
+  they are chronology of a moment, not claims about the present.
+
 ### Mutation gate — nine weeks red from a rename ripple and two untested one-liners
 
 * **The weekly Mutation Testing workflow last passed on 2026-07-05** and failed
 
@@ -126,7 +126,7 @@ Push, PR mutations and release actions require explicit owner authorization.
   [perf/live-iceberg-materialization-2026-08-01.md](perf/live-iceberg-materialization-2026-08-01.md).
   Full one-event lake-to-serving smoke is also **PASS** — see
   [perf/full-lake-to-serving-e2e-2026-08-01.md](perf/full-lake-to-serving-e2e-2026-08-01.md)
-  (local evidence commit `cf247ba`, unpushed).
+  (evidence commit `cf247ba`, in `origin/main` since the 2026-09-08 push).
   Isolated checkpoint restore/replay is **PASS** with distinct J1/J2,
   savepoint restore linkage, exact-once E1/E2 counts across Kafka, Iceberg,
   ClickHouse, and API, DLQ `0`, and source lag `0` — see
 
@@ -197,13 +197,17 @@ contract is honest, the live delivery path is not claimed):
   `plan`, or `apply` ran against the real S3 backend. DynamoDB locking is
   retained on the tracked configuration; a live-backend migration to
   `use_lockfile` still needs AWS access.
-- **ASSUMPTION-T-36-CI-LOCK**: the provider-lock step in
-  `.github/workflows/ci.yml` `terraform-validate` runs
+- **ASSUMPTION-T-36-CI-LOCK** — discharged 2026-09-08. The provider-lock
+  step in `.github/workflows/ci.yml` `terraform-validate` runs
   `terraform providers lock -platform=linux_amd64 -platform=darwin_arm64
-  -platform=windows_amd64` and `git diff --exit-code .terraform.lock.hcl`.
-  It is a tracked guard for `linux_amd64` on `ubuntu-latest` (and the other
-  two documented platforms), not observed evidence. It cannot have passed
-  on a GitHub runner until the owner pushes.
+  -platform=windows_amd64` followed by `git diff --exit-code
+  .terraform.lock.hcl`. It was a tracked guard with no runner behind it until
+  the work reached `origin`; it has since passed on `ubuntu-latest` (run
+  34213482386, `terraform-validate` success, step "Provider lock covers
+  linux_amd64"), which is the evidence that the tracked lock covers the
+  platform CI actually runs on. What remains unobserved is only the
+  `darwin_arm64` / `windows_amd64` halves being *used*, as opposed to being
+  regenerated identically — CI has no runner on either.
 
 ## State-key and role scope
 
 
@@ -92,8 +92,8 @@ Read-only GitHub Environment `npm` verification recorded at
 `2026-08-03T03:18:11Z` is **PASS**: the Environment exists and its non-empty
 `required_reviewers` rule names user `brownjuly2003-code` — see
 [operations/npm-environment-approval-2026-08-03.md](operations/npm-environment-approval-2026-08-03.md).
-Tracked full-smoke evidence is recorded in local evidence commit `cf247ba`
-(local-only, unpushed).
+Tracked full-smoke evidence is recorded in evidence commit `cf247ba`, which
+reached `origin/main` in the 2026-09-08 push.
 
 ## Summary