docs: establish current product technical gap baseline

CHANGELOG.md

@@ -5,8 +5,9 @@ All notable product and architecture changes are recorded here. Releases use imm
 ## Unreleased
 
 ### Added
-- Personal result export delivery authorization (`authorize_result_export_read`) reuses the stored-record `ReadOwnResult` check on the product-owned participant and immutable result, then requires the export's result snapshot reference and copied participant reference to match that exact snapshot. A cross-tenant caller fails closed with the ordinary result-authorization denial before export-binding details are evaluated, so a mismatched export is not an existence oracle. No new permission, HTTP export transport, or persistence is introduced. This is the post-#231 export-delivery guard (ADR-0010 provenance; ADR-0003 tenant-bound authorization).
-- Personal result export copies one immutable snapshot into JSON and a human-readable report so a purchaser can archive the same Extraversion estimate, standard error, and version provenance they were shown. The owner participant reference stays in both artifacts. Abstained or failed constructs keep their disposition and do not receive an invented score. Approved limitation text is required. HTTP export transport remains a later slice. Prefer #231 for this domain copy.
+- Personal result export delivery authorization (`authorize_result_export_read`) reuses the stored-record `ReadOwnResult` check on the product-owned participant and immutable result, then requires the export's result snapshot reference and copied participant reference to match that exact snapshot. A cross-tenant caller fails closed with the ordinary result-authorization denial before export-binding details are evaluated, so a mismatched export is not an existence oracle. No new permission or persistence is introduced; authorized HTTP transport ships through merged `src/result_export_http.rs` and `openapi/result-exports.yaml`. This is the post-#231 export-delivery guard (ADR-0010 provenance; ADR-0003 tenant-bound authorization).
+- Personal result export copies one immutable snapshot into JSON and a human-readable report so a purchaser can archive the same Extraversion estimate, standard error, and version provenance they were shown. The owner participant reference stays in both artifacts. Abstained or failed constructs keep their disposition and do not receive an invented score. Approved limitation text is required.
+- Product and technical gap baseline records the exact protected-main snapshot, current participant-visible gaps, all open repository PRs, issue #260 dependency, and the next executable delivery loop.
 - Anonymous session command authorization compares the verified actor to the supplied participant tenant/owner and session reference, then applies a lifecycle command only after that check. The command entry point does not accept a caller-built resource scope and does not claim those aggregates were store-loaded. The lower-level exact-resource check remains available for callers that already hold a stored `ResourceScope`. Participant persist/reload remains Target.
 - Public `POST /v1/sessions` and `GET /v1/sessions/{session_ref}` start and reload a created session from the stored published release locked in the same transaction. `Idempotency-Key` is the durable session reference. Exact replay after later persist Suspend or Retire returns the original session; a new session after that later persist fails closed with RFC 9457 problem details that tell the buyer to publish the release.
 - New assessment sessions start only from a currently published release. Durable start locks the stored `instrument_release` row (`created_session_for_start` / `start_created_assessment_session` / `start_created_assessment_session_from_stored_release`) so a stale in-memory Published object cannot insert after persist Suspend or Retire. First insert through `persist_assessment_session` takes the same lock, so a reconstituted Created aggregate cannot insert after that later persist. When that lock finds a missing or unpublished release, persist still classifies an exact stored Created row as duplicate so a concurrent retry after the first insert commits cannot turn a later Suspend or Retire into a false unpublished failure. A draft, suspended, retired, missing, or digest-mismatched stored release fails closed before a first insert when no exact stored row exists. Exact replay of an already stored start or Created row still returns the original session after a later persist Suspend or Retire, so a buyer who already started can retry. Reconstituting stored identity remains load, not start.

README.md

@@ -16,12 +16,13 @@ It does **not** duplicate psychometric numerical kernels, identity credentials,
 
 ## Personal result export
 
-Active PR #231 — not protected-main truth until an unchanged reviewed/check-clean head is integrated. After a result snapshot exists, call `ResultExport::from_snapshot` with an opaque `export_ref`, the exact BCP 47 report locale, and approved limitation text. Copy the returned JSON or human-readable report to the participant. Confirm Extraversion (or another scored construct) and its standard error match the snapshot before handing the file over. If export fails, repair the identity, locale, timestamp, or limitation text before offering a download. Do not invent a type score, do not mask the owner `participant_ref`, and do not treat this domain copy as the HTTP `POST /v1/results/{result_ref}/exports` transport.
+Protected-main result-export domain evidence is available through `ResultExport::from_snapshot`. Before creating or delivering an export, the server must authorize the authenticated actor against the exact stored result resource, its owning participant, and tenant scope; caller-supplied result, participant, or tenant values are never authority. Only after that authorization succeeds, call `ResultExport::from_snapshot` with an opaque `export_ref`, the exact BCP 47 report locale, and approved limitation text, and deliver the returned JSON or human-readable report to the participant. Before delivery, confirm that every exported construct score, disposition, present standard error, and version provenance match the immutable result snapshot. If authorization or export fails, do not deliver an artifact; repair the authoritative identity/access evidence or the locale, timestamp, or limitation text as appropriate. Do not invent a type score, do not mask the owner `participant_ref`, and do not treat this domain copy as the HTTP `POST /v1/results/{result_ref}/exports` transport; authorized HTTP delivery remains an active slice.
 
 ## Documentation
 
 ### Product, technical, and governance baseline
 
+- [Product and Technical Gap Baseline](docs/product-technical-gap-baseline.md) — exact protected-main snapshot, current open PR/issue inventory, buyer-visible gaps, and the next executable loop.
 - [Product Requirements](docs/PRD.md) — users, consumer MVP, longitudinal and research experiences, acceptance criteria, exclusions, and release policy.
 - [Technical Requirements](docs/TRD.md) — APIs/events/data contracts, state machines, identity/tenancy, idempotency, failure modes, security/privacy, accessibility, deployment, and release gates.
 - [Psychometric Measurement Governance](docs/MEASUREMENT_GOVERNANCE.md) — factor/model selection, scoreability, recovery, DIF/invariance, multilevel/time/facet structure, automated scoring, and governed rubric/item-bank evidence required for publication.

docs/DOCUMENTATION_ASSESSMENT.md

@@ -1,8 +1,8 @@
 # Documentation Completeness Assessment
 
 - Status: Architecture baseline assessment
-- Date: 2026-08-10
-- Evaluated protected-main baseline: `748876c12f443cc3325448927271199fd98db733`
+- Date: 2026-08-21
+- Evaluated protected-main baseline: `4499d9c0889c082487ddbd7fd8d0d5d18257995d`
 - Scope: product, architecture, psychometric, longitudinal, research, AI, privacy, integration, quality, risk, compliance-readiness, operations, and durable product decisions established throughout the Psychometrics Commons design discussion
 
 ## Executive assessment
@@ -11,7 +11,7 @@ The repository is **sufficient as an implementation architecture baseline**. It
 
 The material defect was not absence of PRD/TRD/Architecture. Those artifacts are strong. The defect was **traceability and view drift after protected-main implementation advanced**: `src/item_delivery.rs`, `src/participant.rs`, `src/authorization.rs`, and `src/integration.rs` were merged while `docs/TRACEABILITY.md` still described those responsibilities as Target; the logical ERD did not yet model item-delivery evidence, append-only account-link history, or the Commons-owned longitudinal orchestration records; and UML did not make the Measurement Workbench publication-evidence flow or Gyeot→Commons→TEPP sequence explicit.
 
-This reconciliation closes those architecture-definition gaps without promoting active PR work or target diagrams to shipped truth. PostgreSQL evidence persistence on PR #24 remains **Active PR**, not protected-main implementation. OpenAPI/AsyncAPI, physical DDL beyond actual migrations, deployed topology, measured SLO/RPO/RTO, certification, and instrument-release evidence remain implementation/evidence-gated and must not be fabricated.
+This reconciliation closes those architecture-definition gaps without promoting active PR work or target diagrams to shipped truth. PostgreSQL evidence persistence from merged #24 is protected-main only for the migrations/adapters that are actually present; remaining aggregate persistence, OpenAPI families beyond sessions, deployed topology, measured SLO/RPO/RTO, certification, and instrument-release evidence remain implementation/evidence-gated and must not be fabricated.
 
 ## Current artifact sufficiency
 
@@ -29,7 +29,7 @@ This reconciliation closes those architecture-definition gaps without promoting
 | Research governance | **Sufficient as design baseline** | Purpose-specific contribution, pseudonymization/linkage boundary, privacy/scientific review and immutable release semantics are present. End-to-end release evidence remains Target. |
 | Product experience | **Sufficient as design baseline** | Quick/Deep/Reflect/Longitudinal, continuous-score interpretation, narrative UX, research opt-in, accessibility/i18n and Workbench surfaces are described. |
 | Quality / risk / compliance readiness | **Sufficient as assurance baseline** | Evidence scenarios and risk state are explicit; readiness is not certification. |
-| Traceability | **Repaired in this reconciliation** | Baseline now names exact protected-main `748876…`, marks newly merged domain modules Implemented/Partial, and isolates PR #24 as Active PR. Must be updated after every material merge. |
+| Traceability | **Repaired in this reconciliation** | Baseline now names exact protected-main `4499d9c…`, reconciles merged result/session/anonymous-authorization/scoring-adapter slices, and isolates still-open PRs from shipped truth. Must be updated after every material merge. |
 | Roadmap / agent guidance / changelog | **Sufficient for continued delivery** | Must remain code-current; documentation completion is not a terminal condition for the execution loop. |
 | Machine-readable OpenAPI / AsyncAPI | **Not yet applicable as as-built evidence** | Add and validate with the first implemented HTTP/event transport. Do not publish aspirational operations as deployed. |
 | Physical schema / as-built topology | **Partial / implementation-gated** | Logical ERD is authoritative target semantics. Actual migrations/topology/rollback/restore evidence must be compared to it as those artifacts land. |
@@ -62,16 +62,17 @@ Enterprise issue prioritization/causal expected-intervention-value logic is not
 
 ## Protected-main implementation reconciliation
 
-At exact protected-main `748876c12f443cc3325448927271199fd98db733` the domain surface includes, among other existing modules:
+At exact protected-main `4499d9c0889c082487ddbd7fd8d0d5d18257995d` the domain surface includes, among other existing modules:
 
 - `src/item_delivery.rs` — sequence-aware item delivery evidence;
 - `src/participant.rs` — stable participant identity and first optional Keyverse link primitive;
 - `src/authorization.rs` — fail-closed tenant/task authorization domain gates;
 - `src/integration.rs` — outbox/inbox/retry/quarantine domain contracts.
+- `src/scoring_engine.rs` — request-bound external scoring-engine adapter boundary.
 
 Those modules are now represented as protected-main evidence in `docs/TRACEABILITY.md`. Their HTTP/persistence/live-adapter layers are not inferred from the existence of the domain structs.
 
-PR #24 (`feat/postgres-integration-persistence`) remains an active implementation lane. Any PostgreSQL evidence adapter or migration that exists only on that PR remains `IMPLEMENTED_ON_ACTIVE_PR` until the exact reviewed/check-clean head is merged and protected main is refetched.
+PR #24 (`feat/postgres-integration-persistence`) and PR #251 (`feat(scoring): enforce request-bound engine adapter results`) are merged. Only the PostgreSQL migrations and adapters actually present on the named protected head are protected-main evidence; live `fast-mlsirm` execution, remaining aggregate persistence, transport, and recovery work remains implementation-gated.
 
 ## Remaining evidence before GA
 

docs/ROADMAP.md

@@ -152,7 +152,7 @@ Deliverables:
 - deterministic Korean/English narratives;
 - standalone Public Assessment client;
 - Result Explorer;
-- JSON and human-readable report export (domain copy on Active PR #231; HTTP transport remains here);
+- JSON and human-readable report export (domain copy is protected main through merged #231; HTTP transport remains here);
 
 Exit criteria: