fix(release): complete local readiness gates

PLAN.md

@@ -71,10 +71,10 @@ encryption, retention, backup, and deployment policy remain host concerns.
 ## Slice 7 — v1 compatibility and closure
 
 - [ ] **User value:** maintainers and adopters receive a reproducible, migration-aware v1 with no known material contradiction and no hidden publication side effect.
-- **State:** In progress — the compatibility audit now names the actually supported matrix, replaces the vague migration-fixture gate with checked-in ABI-v1 bytes plus the real legacy durable-record browser migration, and proves all four canonical example packages together.
+- **State:** Blocked only on externally unavailable audit tools — all reachable local release gates pass, but `cargo-audit` and `cargo-deny` are not installed and dependency installation is not authorized.
 - **Build:** freeze the supported Rust/browser/WASM/integration matrix; reconcile public/generated/Surface/symbol/wire/runtime/persisted-schema compatibility; add migration fixtures; make canonical examples compatibility tests; update the progressive tutorial path; run all local release gates and disposition every P0/P1, advisory, unsafe-code, license, performance, accessibility, and documentation finding.
 - **Refusals:** no publish, deploy, upload, store submission, speculative feature, or weakening a gate to make it pass.
 - **Requirements:** `v1_release/001-010`, `versioning/*`, `test/*`, `diag/*`, `performance/*`, `security/008`, and all requirements changed by the preceding slices.
 - **Proof:** clean-tree formatting, workspace tests, strict all-target Clippy, compile-fail, browser/WASM/offline/multiplayer scenarios, benchmark budgets, approved pinned lockfile audit, requirements proof audit, docs/examples checks, and independent contradiction review all pass with no unresolved P0/P1.
 
-`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and `cargo test -p hemx-v0-examples -p hemx-client-local-example -p hemx-kanban-example -p hemx-saas-example --lib --bins` prove the first compatibility gate. The release audit fixed three genuine local failures: the app-facing durable-sync primitive now accepts ordinary `IntoEffect`, the canonical example contract recognizes the explicitly isolated legacy fixture, and the requirement corpus is mechanically migrated from duplicated legacy headings/ring prefixes to the installed redgate `## component` plus `ID<TAB>SUMMARY` format without changing its 413 obligations. `cargo run -p hemx-xtask -- test` now passes the complete workspace, browser, techdemo, and citation-reference gate. `cargo audit --version` and `cargo deny --version` both fail with Cargo `no such command`; dependency installation and an approved pinned-lockfile audit therefore remain externally blocked. Execution cursor: run the remaining local performance/docs/examples/contradiction gates, then obtain explicit authority or a supplied environment for `cargo-audit` and `cargo-deny` before claiming release readiness.
+`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and the four canonical example package tests prove compatibility. The release audit fixed genuine local failures: the app-facing durable-sync primitive accepts ordinary `IntoEffect`, the canonical example contract recognizes the isolated legacy fixture, the 413-requirement corpus is migrated losslessly to installed redgate format, and `html-examples-smoke` launches its child from the workspace rather than the caller directory. `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- bench`, `cargo run -p hemx-xtask -- html-examples-smoke`, strict all-target Clippy, warning-denied workspace docs, and workspace doctests pass. README/readiness contradiction review now matches the proven cursor. `cargo audit --version` and `cargo deny --version` both fail with Cargo `no such command`; dependency installation and the approved pinned dependency/license audit remain externally blocked. Execution cursor: obtain explicit installation authority or a supplied environment containing `cargo-audit` and `cargo-deny`, run the pinned lockfile audits, then close Slice 7 if clean.

README.md

@@ -5,13 +5,14 @@ handlers, and return generated UI commands. The browser receives checked UI
 commands; ordinary server-first apps do not need a frontend framework,
 handwritten UI JavaScript, selector targeting, or raw runtime primitives. req: pitch/001 req: canonical_authoring/001
 
-Status: the repository has a proven server-first/page-enhanced baseline, a
+Status: the evidence-backed v1 behavior slices are implemented and browser-proven:
-compile-tested SaaS tutorial, an advanced Kanban sketch, and a full techdemo.
+server-first/page-enhanced behavior, client-local WASM, durable offline/sync, the
-Full v1 is not yet feature-complete: client-local WASM, durable offline/sync, the
+multiplayer Kanban milestone, and the production reference. Local workspace,
-production integration reference, and their browser/recovery gates remain active.
+browser, performance, documentation, and canonical-example gates pass; the
-See `docs/v1-product-evidence.md` for the evidence-backed product boundary,
+pinned dependency/license audits remain blocked because `cargo-audit` and
-`REQUIREMENTS.md` for authority, `PLAN.md` for implementation order, and
+`cargo-deny` are not installed. See `docs/v1-product-evidence.md` for the product
-`docs/v1-readiness.md` for proven baseline evidence. No publishing is implied.
+boundary, `REQUIREMENTS.md` for authority, `PLAN.md` for execution state, and
+`docs/v1-readiness.md` for evidence. No publishing is implied.
 
 Template authoring: `.heml` is HTML plus a small hemplate overlay for escaped
 text, trusted HTML, dynamic attributes, Rust-shaped control directives, generated

docs/v1-readiness.md

@@ -10,10 +10,15 @@ closure. Their implementation order lives in `PLAN.md`. req: examples/001 req: p
 ## Current status
 
 - Server-first and page-enhanced baseline: proven by the evidence below.
-- Client-local WASM: not implemented; first active v1 slice.
+- Client-local WASM: real generated-resource browser/WASM execution proven.
-- Durable offline/sync: contracts shaped, implementation blocked by the local
+- Durable offline/sync and multiplayer milestone: framework-owned replay,
-  execution boundary.
+  acknowledgement, convergence, presence, recovery, and accessibility proven.
-- Full production reference and v1 closure matrix: not yet proven.
+- Production reference: authenticated mutation, origin/CSRF denial, atomic
+  rollback-safe persistence, restart recovery, health/readiness, diagnostics,
+  metrics, CSP, and mixed-build fail-closed recovery proven.
+- V1 closure matrix: local workspace, browser, performance, docs, and example
+  gates pass; `cargo-audit` and `cargo-deny` remain unavailable and block the
+  approved pinned dependency/license audit.
 - Publishing and deployment: explicitly unauthorized.
 
 ## Baseline evidence

hemx-xtask/src/main.rs

@@ -130,6 +130,7 @@ fn pick_unused_port() -> Result<u16, ExitCode> {
 
 fn start_html_examples_server(addr: &str) -> Result<HtmlExamplesServer, ExitCode> {
     let mut child = Command::new("cargo")
+        .current_dir(workspace_root())
         .args(["run", "-p", "hemx-html-examples"])
         .env(
             "HEMX_HTML_EXAMPLES_PORT",