docs: record live release blockers

AUDIT.md

@@ -3,9 +3,9 @@
 Audited 2026-07-30 against the working tree, spec, deployed coordinator,
 workpc worker, event log, and live herdr (read-only).
 
-**Verdict:** one worker handoff completed, but the system is not safe to run
-unattended. It can skip rotation, omit Git state, split ownership, strand a
-released agent, or reject a valid completion.
+**Verdict:** the source-level P0/P1/P2 fixes are in place and the live
+coordinator can replay its repaired event log, but the system is not safe to
+run unattended until live harness capacity and the worker rollout are restored.
 
 ## Evidence
 
@@ -13,9 +13,25 @@ released agent, or reject a valid completion.
 - Live B17: release `seq=251`, re-lease `252`, completion `262`; the simple
   probe needed six approvals, logged a `409 lease version conflict`, and
   recorded `consumed:0`.
-- Live now: Docker owns the coordinator; the old systemd unit is inactive.
-  Workpc runs a dirty `1ca9d64` worker build. No task is active and live herdr
-  reports no agents. This does not prove the current working tree.
+- Live follow-up: Docker owns the coordinator; the old systemd unit is
+  inactive. The pre-v2 repeated-`seq=1` event prefix was migrated with a
+  backup-preserving, explicit tool before the current coordinator replayed it.
+
+## Remaining release blockers
+
+- **No live harness capacity.** Homesrv has no reachable herdr. Workpc has no
+  listener on any expected herdr port, so no safe live rotation, handoff,
+  completion, or late-recovery path can be exercised on Claude, Codex, or
+  OpenCode.
+- **Worker rollout needs an administrator.** Workpc is still running the old
+  dirty `1ca9d64` `/usr/local/bin/orchestra-worker`. The current worker binary
+  is staged at `~/orchestra-deploy/orchestra-worker`, but this account cannot
+  install it or restart the systemd service. Its project configuration must
+  also declare supported projects before routing can admit a task.
+- **B17 needs a fresh controlled run.** The historical probe's six approvals,
+  one `409 lease version conflict`, and `consumed:0` receipt came from the
+  old worker. They cannot be treated as evidence for the current worker until
+  a live OpenCode run is repeated; Claude and Codex require their own runs.
 
 ## P0 — correctness
 
@@ -86,13 +102,11 @@ released agent, or reject a valid completion.
 
 ## Release gate
 
-- All build/vet/test/race checks pass.
-- Fault-inject every handoff phase, coordinator/worker restart, lost response,
-  worker partition/rejoin, stale completion, and corrupt state file.
-- Cross-machine tests cover staged/deleted/clean-committed work and prove the
-  predecessor remains recoverable until successor pickup validation.
-- Live controlled runs pass soft, hard, milestone, thrash, completion, and
-  late-recovery paths on each harness without manual intervention for safe
-  repository work.
-- Coordinator and workers report the same immutable build revision; staged
-  worker checksum and Go build revision match before restart.
+- **Pass:** build, vet, test, and race checks pass; unit/integration coverage
+  includes the defined fault and cross-machine cases.
+- **Pending live capacity:** run the controlled soft, hard, milestone, thrash,
+  completion, and late-recovery paths on each harness without manual
+  intervention for safe repository work.
+- **Pending worker installation:** install the staged worker, restart it after
+  herdr is restored, and verify its checksum and immutable build revision
+  against the coordinator diagnostics.