docs: refresh product gap baseline and product README

docs/RISK_REGISTER.md

@@ -22,7 +22,7 @@ This register tracks material product, scientific, privacy, security, operationa
 | Hosted runtime returns fallback/invented score during fast-mlsirm outage/scientific failure | critical | medium | mitigated_by_architecture | typed fail-closed scoring contract, durable pending job; end-to-end failure injection required |
 | Instrument content changes without version change and historical result becomes unreproducible | critical | low | implementation_in_progress | immutable publication/version contract, content digest, result provenance; persistence constraints pending |
 | Session/response race creates duplicate or inconsistent scoring evidence | high | medium | implementation_in_progress | idempotent response ledger + immutable snapshot; real DB concurrency/atomic outbox tests pending |
-| Cross-tenant object reference exposes another user's session/result/research/data-rights state | critical | medium | evidence_required | tenant/resource authorization architecture; transport/persistence negative tests pending |
+| Cross-tenant object reference exposes another user's session/result/research/data-rights state | critical | medium | implementation_in_progress | result-export authorization is protected-main evidence; session reload remediation is Active PR #438 at `67f4508f85ec3483c1358b8c1db99e4c92ba0727`; transport/persistence negative tests and protected-main refetch remain pending |
 | Anonymous-to-account link permits account takeover/history theft | critical | medium | evidence_required | dual proof-of-control + Keyverse validation; adapter and adversarial tests pending |
 | Keyverse identity role is confused with product/research authorization | high | medium | mitigated_by_architecture | separate domain authorization and separation-of-duties policy; integration tests pending |
 | Research release contains operational/Keyverse/linkage identifier | critical | medium | mitigated_by_architecture | restricted linkage + release validation; adversarial release pipeline pending |
@@ -42,7 +42,7 @@ This register tracks material product, scientific, privacy, security, operationa
 | Factor rotation is marketed as globally optimal/universally best | medium | medium | mitigated_by_architecture | best-observed multi-start + stability/recovery policy; no universal criterion claim |
 | Published research/score artifacts mutate in place after correction | high | low | mitigated_by_architecture | content addressing + supersession; physical DB/object-store constraints pending |
 | Cross-service direct database access creates hidden coupling/privacy blast radius | high | medium | mitigated_by_architecture | ADR-0001/0015; credential/dependency fitness tests pending |
-| Outbox/inbox replay duplicates external release/deletion/scoring side effects | high | medium | evidence_required | transactional outbox/inbox design plus Active PR #264 exact-event publisher-to-fenced-persistence handoff; live worker, crash/recovery, and external side-effect idempotency evidence pending |
+| Outbox/inbox replay duplicates external release/deletion/scoring side effects | high | medium | evidence_required | transactional outbox/inbox design plus protected-main exact-event publisher-to-fenced-persistence handoff from merged #264; live worker, crash/recovery, and external side-effect idempotency evidence remain pending |
 | Optional dependency outage is reported as total product outage or blocks personal results | medium | medium | mitigated_by_architecture | capability-scoped readiness/degradation; deployment failure tests pending |
 | Community profile silently depends on g7/AI/TEPP/portal | high | low | mitigated_by_architecture | ADR-0002/0011 + deployment profile contract; install/end-to-end proof pending |
 | OpenAPI/AsyncAPI target docs are published before implementation and mislead integrators | medium | medium | mitigated_by_architecture | ADR-0014 as-built-only contract rule; CI gate pending |

docs/adr/0014-api-and-event-contract-representation.md

@@ -6,9 +6,9 @@
 - Scope: Psychometrics Commons public/admin HTTP APIs, product-owned durable domain events, errors, schema/version negotiation
 - Supersedes: none
 - Superseded by: none
-- Current/as-built status: persist-backed session create/reload HTTP (`POST /v1/sessions`, `GET /v1/sessions/{session_ref}`, `openapi/sessions.yaml`) exists on Active PR #232 and is not protected-main truth; remaining public/admin families and durable external event transport are still unimplemented on protected main
+- Current/as-built status: persist-backed session create/reload HTTP (`POST /v1/sessions`, `GET /v1/sessions/{session_ref}`, `openapi/sessions.yaml`) is protected-main implementation evidence through merged #232; remaining public/admin families and durable external event transport are still incomplete on the evaluated protected-main baseline
 - Target status: every implemented HTTP/event surface has an exact versioned machine-readable as-built contract and deterministic integrity/idempotency semantics
-- Migration status: no deployed HTTP/event transport requires migration yet; the first implementation must introduce the contract in the same or prerequisite PR
+- Migration status: the protected-main session HTTP family ships with its OpenAPI contract and existing session persistence migrations; each additional HTTP/event family must introduce its machine-readable contract in the same or a prerequisite change and add persistence migration only when that family owns new durable state
 
 ## Context
 
@@ -103,7 +103,7 @@ When durable event transport is implemented, the AsyncAPI/schema artifact must e
 
 ## Data and persistence impact
 
-No transport persistence exists yet on protected main. The target logical model requires outbox event identity, tenant/subject binding, schema/canonicalization version, payload digest, delivery attempts, inbox deduplication identity, processing state, side-effect evidence, and quarantine/reconciliation evidence. `docs/architecture/ERD.md` defines the logical target; physical migrations must preserve these semantics when introduced.
+Protected main already contains product-owned persistence used by the implemented session HTTP family. Durable external event transport remains incomplete: its target logical model requires outbox event identity, tenant/subject binding, schema/canonicalization version, payload digest, delivery attempts, inbox deduplication identity, processing state, side-effect evidence, and quarantine/reconciliation evidence. `docs/architecture/ERD.md` defines the logical target; physical migrations must preserve these semantics when introduced.
 
 ## Invariants
 
@@ -153,7 +153,7 @@ Transport/broker choice is deployment-specific, but health and reconciliation mu
 
 ## Migration and rollout
 
-The first implemented HTTP transport must introduce its OpenAPI document in the same PR or an accepted prerequisite PR. The first durable event transport must do the same for AsyncAPI plus the canonicalization/digest implementation and persistence constraints.
+The session HTTP family satisfied the HTTP side of this ADR by landing its implementation and `openapi/sessions.yaml` together through merged #232. Each later HTTP family must introduce or update its exact OpenAPI contract in the same PR or an accepted prerequisite PR. The first durable event transport must do the same for AsyncAPI plus the canonicalization/digest implementation and persistence constraints.
 
 Contract changes are validated before deployment. During compatibility windows, old and new versions may be served/consumed concurrently only when the implementation has explicit routing/adapter tests.
 
@@ -165,7 +165,7 @@ Rollback must restore an application version that still understands any messages
 - `docs/architecture/UML.md` must not model receipt as equivalent to externally visible side-effect completion.
 - `docs/architecture/SECURITY_AND_DATA.md` must preserve tenant/purpose boundaries for event payloads and quarantine.
 - `docs/architecture/DEPLOYMENT_AND_OPERATIONS.md` must include replay/quarantine/recovery evidence when event transport is implemented.
-- `docs/TRACEABILITY.md` remains target until as-built OpenAPI/AsyncAPI and transport tests exist.
+- `docs/TRACEABILITY.md` must distinguish the protected-main session HTTP family from target or active-PR transport families and bind each implemented family to its exact machine-readable contract.
 
 ## Validation and release evidence
 
@@ -186,7 +186,7 @@ Release gates for an implemented transport include:
 - client/consumer compatibility tests for the supported window;
 - security tests that verify examples/errors/quarantine evidence do not disclose prohibited data.
 
-Until the transport exists, these are explicit target acceptance requirements rather than fabricated passing evidence.
+These are release requirements for the transport families to which they apply; absence of a not-yet-implemented family is not converted into fabricated passing evidence.
 
 ## Alternatives considered
 
@@ -233,7 +233,7 @@ Costs:
 
 ## Follow-up work
 
-- when the first HTTP transport lands, add the exact OpenAPI document and route/problem contract tests;
+- keep each implemented HTTP family synchronized with its exact OpenAPI route/problem contract tests;
 - when the first durable event transport lands, add AsyncAPI plus canonicalization/digest test vectors and tenant-bound outbox/inbox migrations;
 - add consumer crash/replay/quarantine integration tests against the selected persistence/broker adapters;
 - link deployment-specific deduplication-retention policy to backup/restore and broker retention evidence.
@@ -244,7 +244,7 @@ Costs:
 - Technical requirements: `docs/TRD.md` API, event, transactional integration, version compatibility, security, and validation sections.
 - Architecture: `ARCHITECTURE.md`, `docs/architecture/ERD.md`, `docs/architecture/UML.md`, `docs/architecture/DEPLOYMENT_AND_OPERATIONS.md`.
 - Decisions: ADR-0015 for persistence/transaction boundaries.
-- Delivery evidence: `docs/TRACEABILITY.md`, `docs/ROADMAP.md`, `tests/documentation_architecture_contract.rs` until as-built transport tests replace documentation-only fitness evidence.
+- Delivery evidence: `docs/TRACEABILITY.md`, `docs/ROADMAP.md`, tests for implemented transport contracts, and `tests/documentation_architecture_contract.rs` for documentation fitness.
 
 ## Reversal conditions