docs: record final security gate evidence

AUDIT.md

@@ -222,21 +222,38 @@ after emptying a directory reopens it relative to the pinned parent, verifies
 its volume and file index against the traversal handle, and marks only that
 identity-checked handle for deletion. The live-workspace
 regression injects a directory symlink and verifies that its external sentinel
-survives. These are reviewed fixes and regression coverage,
-not independent certification or proof that a 5.2.8 hosted gate passed.
+survives. These are reviewed fixes and regression coverage, not independent
+certification or proof that an exact-tag 5.2.8 gate passed.
 
 The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7,
 then reported High #8, #9, and #10 solely in the newly added SDK regression:
 its sentinel and mode checks used `stat`/`lstat` before later path operations.
 Each individual content or metadata check now opens without following links
 and uses `fstat` or reads through that already-open descriptor. A static guard
-rejects a return to path-level `stat`/`lstat` in this test. A fresh
-default-branch scan remains the authoritative closure evidence.
+rejects a return to path-level `stat`/`lstat` in this test. The subsequent
+C/C++ default-branch scan run `33452563116` completed successfully at commit
+`7a8e5c5`; alerts #5 through #10 are fixed, and the authenticated
+code-scanning API reported zero open alerts.
 
-The exact 5.2.8 candidate must repeat the required suite. Native Windows and
-macOS gates, hosted GitHub CI and release promotion, authenticated OBS
-validation, and resolution of the openSUSE automatic `debugsource` rpmlint
-`no-binary` finding remain pending until recorded otherwise.
+Manual pre-tag CI run `33452602634` at the same functional commit completed 14
+of 15 jobs successfully. Linux compilers, analyzers, sanitizers, source policy,
+reproducibility, DEB, RPM/SRPM, portable bundles, and the native macOS DMG gate
+passed. On Windows, source audit, build, and `make check` passed; the subsequent
+smoke failed only when the old MSYS `grep` tried to match a literal non-BMP
+filename after ZUPT had compressed and verified all five inputs. Independent
+MinGW/Wine reproduction confirmed that the redirected ZUPT listing contained
+the exact UTF-8 bytes. The gate now creates the non-BMP name through byte
+escapes, verifies Latin-1/BMP/non-BMP listing bytes without locale-sensitive
+matching, and requires extraction plus a full tree diff. The path-confinement
+regression independently constructs the BMP/non-BMP archive name from ASCII
+hex and requires byte-exact listing and extraction.
+
+Because that pre-tag run failed, it is diagnostic evidence rather than release
+approval. The exact 5.2.8 candidate must repeat the required suite. Exact-tag
+native Windows/macOS, hosted CI, authenticated OBS service execution, and
+release promotion remain pending until recorded otherwise. The pre-tag
+openSUSE Tumbleweed job did build source and binary RPMs, pass `rpmlint` without
+suppressions, and pass install/round-trip/uninstall checks.
 
 ## Cryptographic review boundary
 

CHANGELOG.md

@@ -30,7 +30,8 @@ unchanged.
   test-only path checks as High #8, #9, and #10 in the new SDK regression.
   Replace every test-side `stat`/`lstat` sequence with one no-follow `open`
   followed by `fstat` and descriptor reads, and retain that boundary in the
-  static regression gate.
+  static regression gate. Default-branch run `33452563116` completed
+  successfully with #5 through #10 fixed and zero open code-scanning alerts.
 - Treat inability to create the raw-C1 scanner filename as an explicit fixture
   skip on filesystems that reject the byte; when creation succeeds, the unsafe
   diagnostic-escaping assertions still run unchanged. Normalize Bash 3.2's
@@ -43,6 +44,11 @@ unchanged.
   current-user-only DACL that the implementation creates; do not treat MSYS's
   synthetic `stat` mode as a POSIX `0600` result. POSIX continues to require
   the real descriptor mode `0600` under multiple umasks.
+- Replace the old MSYS `grep` non-BMP boundary exposed after 14 successful jobs
+  in pre-tag run `33452602634` with byte-exact Python checks for Latin-1, BMP,
+  and non-BMP UTF-8 listing output. Construct the emoji fixture from ASCII byte
+  escapes and require list, extract, and full-tree equality; the independent
+  path regression also creates its BMP/non-BMP name from ASCII hex.
 - Run `sdk-test` from both `release-check` and the hosted GCC/Clang Linux job so
   the atomic key-save regression cannot silently fall outside release gates.
 - Carry the v5.2.7 archive format, cryptography, bundled codec release, and SDK

DISTRIBUTION.md

@@ -31,7 +31,12 @@ UTF-8 fixture argv transcoding. Version 5.2.7 corrected those failures, but
 exact-tag run `33445470664` ended with 13 successful jobs, a macOS raw-C1
 fixture failure with `EILSEQ`, and a cancelled Windows job after the hosted job
 stalled in `make check`; a MinGW/Wine reproduction isolated a non-console
-password-prompt hang in `_getch`.
+password-prompt hang in `_getch`. Manual 5.2.8 pre-tag run `33452602634`
+subsequently passed 14 of 15 jobs, including native macOS and the complete
+Windows distribution checks, before an old MSYS `grep` non-BMP pattern failed
+in the later smoke. ZUPT's redirected listing was byte-correct; the corrected
+gate uses byte-exact, locale-independent checks and requires extraction plus a
+full tree diff. The failed run is diagnostic evidence only.
 Corrective packages and release assets must use `v5.2.8`; never move or
 overwrite an earlier tag or checksum, and never transfer prior evidence
 automatically. Version 5.2.8 corrects those native test boundaries, hardens

README.md

@@ -15,12 +15,12 @@ diagnostics, and brings `sdk-test` into the
 release and hosted Linux gates. Windows password prompts now reject redirected
 input before entering `_getch` and treat console EOF as an error; its key-file
 regression validates the protected current-user-only DACL rather than an MSYS
-POSIX-mode projection. The C/C++ default-branch scan of commit `69fc26b`
-closed #5, #6, and #7 and exposed test-only #8, #9, and #10 in the new SDK
-regression. Their follow-up uses no-follow descriptors plus `fstat`/descriptor
-reads and requires a fresh default-branch scan for closure. These
-corrections do not change archive format v1.6, cryptography, the bundled codec
-release, or the SDK ABI.
+POSIX-mode projection. The C/C++ default-branch scan run `33452563116` of
+commit `7a8e5c5` completed successfully after the follow-up changed the new SDK
+regression to no-follow descriptors plus `fstat` and descriptor reads. Alerts
+#5 through #10 are fixed, and the authenticated code-scanning API reported zero
+open alerts. These corrections do not change archive format v1.6,
+cryptography, the bundled codec release, or the SDK ABI.
 
 The predecessor `v5.2.7` tag is immutable and was not promoted. Exact-tag run
 `33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
@@ -29,6 +29,16 @@ job. The hosted Windows job stalled in `make check`; a MinGW/Wine reproduction
 attributed the stall to a non-console password prompt entering `_getch`. No
 v5.2.7 evidence transfers automatically to v5.2.8.
 
+Manual pre-tag run `33452602634` then completed 14 of 15 jobs successfully at
+`7a8e5c5`, including the native macOS DMG gate and the Windows build and full
+distribution checks. Its Windows smoke test failed only when the old MSYS
+`grep` matched a literal non-BMP filename after the product had already
+compressed and verified all five files. MinGW/Wine reproduction confirmed the
+exact `F0 9F 98 80` UTF-8 bytes in ZUPT's redirected listing. The corrected
+gate creates that name from byte escapes, validates Latin-1, BMP, and non-BMP
+listing bytes with Python, and requires extraction plus a full tree diff. The
+failed run is diagnostic evidence, not release-candidate approval.
+
 Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
 The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
 SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
@@ -43,9 +53,9 @@ decisions, and benchmark cleanup is descriptor-relative on POSIX and
 handle/reparse-point aware on Windows. The live-workspace symlink regression,
 SDK link-target/mode regression, static path-race guards, portable raw-C1
 fixture with Bash 3.2 unsigned-byte normalization, native redirected-prompt
-and protected-DACL regressions, and `sdk-test` CI step cover
-these boundaries. All current release paths move to 5.2.8 and require fresh
-exact-tag hosted CI, package,
+and protected-DACL regressions, byte-exact BMP/non-BMP Windows list and extract
+checks, and `sdk-test` CI step cover these boundaries. All current release
+paths move to 5.2.8 and require fresh exact-tag hosted CI, package,
 native-platform, source-only, checksum, OBS, and promotion evidence.
 
 ## Corrective changes introduced in 5.2.7

SECURITY.md

@@ -232,8 +232,10 @@ The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7,
 then opened test-only High #8, #9, and #10 because the new SDK regression used
 path-level `stat`/`lstat` before later reads or cleanup. Each individual test
 check now uses a no-follow descriptor with `fstat` or descriptor reads; the
-static gate rejects reintroduction of path-level metadata checks there. A
-subsequent default-branch scan is required as closure evidence.
+static gate rejects reintroduction of path-level metadata checks there. The
+subsequent C/C++ default-branch scan run `33452563116` completed successfully at
+commit `7a8e5c5`; alerts #5 through #10 are fixed, and the authenticated
+code-scanning API reported zero open alerts.
 
 The Windows handle-relative implementation is scoped to normal local Win32
 paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
@@ -364,12 +366,18 @@ promoted: exact-tag run `33445470664` concluded `cancelled` at
 `2026-08-31T23:11:19Z`, with 13 successful jobs, one failed macOS job after
 raw-C1 fixture creation returned `EILSEQ`, and one cancelled Windows job after
 the hosted job stalled in `make check`; a MinGW/Wine reproduction isolated the
-cause to a redirected password prompt entering `_getch`. Version 5.2.8 makes both test boundaries fail
-or skip without hanging, but this is not exact-candidate evidence. Native
-Windows and macOS, hosted GitHub CI/release
-promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
-`no-binary` finding remain pending until recorded otherwise. An unavailable or
-unexecuted environment remains `SKIP`, never `PASS`.
+cause to a redirected password prompt entering `_getch`. Version 5.2.8 makes
+both test boundaries fail or skip without hanging. Manual pre-tag run
+`33452602634` subsequently passed 14 of 15 jobs, including the native macOS
+DMG and the Windows source audit, build, and full distribution checks. The
+remaining Windows smoke failure was an old MSYS `grep` non-BMP pattern boundary
+after ZUPT had compressed and verified all inputs; MinGW/Wine confirmed ZUPT's
+byte-exact UTF-8 listing. The corrected gate validates Latin-1, BMP, and
+non-BMP listing bytes without locale-sensitive matching, then requires
+extraction and a full tree diff. The failed run is not exact-candidate
+evidence. Exact-tag native gates, hosted CI, authenticated OBS service
+execution, and release promotion remain pending. An unavailable or unexecuted
+environment remains `SKIP`, never `PASS`.
 
 Run target-native static analyzers and package checks as additional evidence.
 Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or