docs(gateway): close v10 qualification evidence

openspec/changes/truthful-fixed-frame-qualification/design.md

@@ -8,7 +8,7 @@ Because the bounded fixture uses loopback rather than a physical 1 Gbps link, v8
 
 The retained v6 qualification run passed its then-current checks but is superseded because its tight-loop sender contradicted the pinned Apollo schedule. Private Linux runs 123 and 124 remain failed evidence. One local v8 sustained run passed on Darwin, but it is neither Linux proof nor normative Section 7 evidence.
 
-The later Darwin non-sustained pre-CI invocation was not green and was not retried. Its 1440p120 profile delivered the exact 6,250,000 bytes in 120 frames plus all 6,483 source and warm-up shards with zero drops, but measured 46,973.13 kbps over an implied approximately 1.0644383 seconds and failed the 5% throughput gate. Private Linux full verification/artifact retention and the replacement v10 normative run remain open.
+The later Darwin non-sustained pre-CI invocation was not green and was not retried. Its 1440p120 profile delivered the exact 6,250,000 bytes in 120 frames plus all 6,483 source and warm-up shards with zero drops, but measured 46,973.13 kbps over an implied approximately 1.0644383 seconds and failed the 5% throughput gate. At that point, private Linux full verification/artifact retention and the replacement v10 normative run were still open.
 
 Private Linux run 125 at the frozen v8 harness head is retained as failed evidence. Its exact 33-datagram gap between successful fixture writes and production `MediaIngress` equaled the Linux socket's 33 measured kernel UDP drops. The complete-frame queue, fair pacer, QUIC fragmentation, and public decoder were downstream and did not account for the loss.
 
@@ -28,6 +28,12 @@ Qualification v10 keeps the logical impairment CSV unchanged and adds only `impa
 
 The independent parser's caller explicitly selects smoke or normative authority. Normative validation requires exactly 10,000 sent logical units and always enforces the ten-second convergence and 105% rolling-cap gates; retained `sent` data cannot weaken them. Both wire and fairness readers reject compressed input before hashing when it exceeds a writer-derived bound, feed gzip output through a bounded standard-library reader before CSV parsing, and bound fields, offsets, flows, and encoded lengths from the canonical row count, schema, time horizon, and writer values. Aggregate-only v9 data and malformed schema/hash/count/order/transition/length or oversized inputs remain rejected.
 
+Private Linux run 129/job 483 and artifact 29 at `c0e362c0285d267f8af4087d07943822311f60e1` passed execution, artifact-byte, and at-least-30-elapsed-day retention checks. Its subsequent v9 a2 qualification remains runtime-passing but normative-raw-evidence-incomplete. Exact v10 source `ce3b3079837c5745f95a51c98eb6204363962ae7` then passed its one private Linux push attempt in run 130/job 484: `make verify`, the sustained gate, strict OpenSpec, deterministic artifact build/upload, and clean checkout all passed. The retained run log is SHA-256 `7e23011db2cb3118ca6cd940cfdc59ba4b536de39276d6b6a74c5862c745b0fa`. Artifact 30's ZIP is SHA-256 `59f938f9187255ad015fa5608b49909e89a065e4f5ba515b7450608b8048b1cc` at 12,957,227 bytes; its amd64 binary is `33ecd42cee0e01bc15aa87aa0610bfb165b2a2b379133110271c98d717584cc1` at 12,367,020 bytes, its arm64 binary is `4b6fc560e23fd8e283219f63ac4a33881863d12644676fb6e5a7d9fc4523182b` at 11,525,817 bytes, and its source-correct SPDX is `a1c2ae2bc4a8c0e0dea67ac53dbf8bb6135399cecb8d6fd153e9b59174ec35b9` at 8,090 bytes. The API recorded exactly 2,592,000 seconds of retention. The binaries remain unchanged because v10 changes retained test evidence only; the SPDX truthfully remains unscanned and unsigned.
+
+Two subsequent ce3 elevated-execution preflights were denied before `CreateProcess`. No `go test` process started, no target was created, and neither event consumed a qualification attempt; they remain environment/approval history rather than runtime failures. The later owner-approved elevated direct command ran exactly once at ce3 with immutable Protocol RC10, exited zero, and passed `TestSection7Qualification` in 1,917.92 seconds (package 1,918.491 seconds). It produced mode-0750 `gateway-rc10-ce3b307` with 17 files totaling 4,179,714 bytes and a passed v10 manifest SHA-256 `53f1e24a3182887d496b745826af20c7b220a3a0cc2e1682baf1eb746f4c240d`.
+
+Independent review recomputed 36,000/72,000/36,000 processing frames and 11.25 GB of exact payload, including payload digests, statistics, isolated resources, and all eight logical impairment files. It also recomputed the constrained wire artifact's 15,060 rows as 15,058 ordered 1,200/25-byte deliveries plus canonical 25%/50% transitions, including full-tail convergence and maxima. The fairness artifact retained 70,916 rows; stage-bounded recomputation reproduced Jain index `0.9999999546920958`, maximum share error `0.0003749275708101844`, and the two-second 25%/50% convergence/maxima. Identity, hashes, bounded grammar, and preservation checks found no material mismatch. These results remain deterministic fixture evidence only and do not prove live Apollo, the native macOS client, a physical firewall or route, a real encoder, multi-host operation, Phase 3C-C, vulnerability scanning, signing, deployment, or promotion.
+
 The ingress repair follows reviewed behavior rather than copying implementation source:
 
 - Apollo `adc5c5a0bd80831ce495434bb16aee2cd4175fb8`, GPL-3.0, `src/stream.cpp:1463-1474,1573-1627`, supplies the 80%-of-1-Gbps raw-block pacing, 64-KiB/64-packet batch cap, and cross-frame send schedule used by the fixture.