diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3ffb4a8..1ae3401 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -68,11 +68,7 @@ jobs:
             echo "Expected one of: mix.exs, Cargo.toml, build.zig, deno.json, gossamer.conf.json, gleam.toml, rebar.config, Justfile"
             exit 1
           fi
-        # TODO: Upload build artifacts if needed
-        # - uses: actions/upload-artifact@v4
-        #   with:
-        #     name: release-artifacts
-        #     path: target/release/
+        # Library: no release binary to upload (Zig FFI is not a tagged product).
   changelog:
     name: Generate Changelog
     runs-on: ubuntu-latest
@@ -122,11 +118,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v7.0.1
-      # TODO: Download build artifacts if uploading to the release
-      # - uses: actions/download-artifact@v4
-      #   with:
-      #     name: release-artifacts
-      #     path: artifacts/
+      # No binary artifacts — notes-only GitHub Release.
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3.0.3
         with:
@@ -134,9 +126,6 @@ jobs:
           draft: false
           prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
           generate_release_notes: false
-          # TODO: Add artifact files to the release
-          # files: |
-          #   artifacts/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   provenance:
diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile
index 24b119a..4493a4d 100644
--- a/.machine_readable/contractiles/Justfile
+++ b/.machine_readable/contractiles/Justfile
@@ -52,7 +52,7 @@ info:
     @echo "Version: {{version}}"
     @echo "RSR Tier: {{tier}}"
     @echo "Recipes: $(just --summary | wc -w)"
-    @[ -f ".machine_readable/descriptiles/STATE.deed" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.deed | head -1 | xargs -I{} echo "Phase: {}" || true
+    @[ -f ".machine_readable/descriptiles/STATE.deed" ] && grep -oP ':phase\s+\K[A-Za-z]+' .machine_readable/descriptiles/STATE.deed | head -1 | xargs -I{} echo "Phase: {}" || true
 
 # Run Invariant Path overlay tools for this repository
 invariant-path *ARGS:
@@ -547,16 +547,16 @@ import? "build/just/validate.just"
 # STATE MANAGEMENT
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Update STATE.deed timestamp
+# Attempt to update the timestamp in a key-value-formatted STATE.deed
 state-touch:
     @if [ -f ".machine_readable/descriptiles/STATE.deed" ]; then \
-        sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.deed && \
+        sed -i 's/:last-updated "[^"]*"/:last-updated "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.deed && \
         echo "STATE.deed timestamp updated"; \
     fi
 
-# Show current phase from STATE.deed
+# Show the phase from a key-value-formatted STATE.deed
 state-phase:
-    @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.deed 2>/dev/null | head -1 || echo "unknown"
+    @grep -oP ':phase\s+\K[A-Za-z]+' .machine_readable/descriptiles/STATE.deed 2>/dev/null | head -1 || echo "unknown"
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # GUIX (channels — Nix is deprecated)
diff --git a/.machine_readable/contractiles/adjust/README.adoc b/.machine_readable/contractiles/adjust/README.adoc
index b6da5bd..6c4c522 100644
--- a/.machine_readable/contractiles/adjust/README.adoc
+++ b/.machine_readable/contractiles/adjust/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.
diff --git a/.machine_readable/contractiles/intend/README.adoc b/.machine_readable/contractiles/intend/README.adoc
index 5c257b6..a0b3cc2 100644
--- a/.machine_readable/contractiles/intend/README.adoc
+++ b/.machine_readable/contractiles/intend/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.
diff --git a/.machine_readable/contractiles/must/README.adoc b/.machine_readable/contractiles/must/README.adoc
index b5557a3..119fd65 100644
--- a/.machine_readable/contractiles/must/README.adoc
+++ b/.machine_readable/contractiles/must/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.
diff --git a/.machine_readable/contractiles/trust/README.adoc b/.machine_readable/contractiles/trust/README.adoc
index 9e42dca..4eacb53 100644
--- a/.machine_readable/contractiles/trust/README.adoc
+++ b/.machine_readable/contractiles/trust/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.
diff --git a/.machine_readable/descriptiles/LANGUAGES.deed b/.machine_readable/descriptiles/LANGUAGES.deed
index f1f4d82..bb42537 100644
--- a/.machine_readable/descriptiles/LANGUAGES.deed
+++ b/.machine_readable/descriptiles/LANGUAGES.deed
@@ -13,4 +13,4 @@
     :config ("nickel" "deed")
     :build ("just" "bash"))
   (planned
-    :core "TBD"))
+    :core "not-implemented"))
diff --git a/Justfile b/Justfile
index bfcf4bd..649dbf3 100644
--- a/Justfile
+++ b/Justfile
@@ -52,7 +52,7 @@ info:
     @echo "Version: {{version}}"
     @echo "RSR Tier: {{tier}}"
     @echo "Recipes: $(just --summary | wc -w)"
-    @[ -f ".machine_readable/descriptiles/STATE.deed" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.deed | head -1 | xargs -I{} echo "Phase: {}" || true
+    @[ -f ".machine_readable/descriptiles/STATE.deed" ] && grep -oP ':phase\s+\K[A-Za-z]+' .machine_readable/descriptiles/STATE.deed | head -1 | xargs -I{} echo "Phase: {}" || true
 
 # Run Invariant Path overlay tools for this repository
 invariant-path *ARGS:
@@ -265,14 +265,10 @@ deps:
     @command -v zig >/dev/null 2>&1 && echo "  [OK] zig" || echo "  [FAIL] zig not found"
     @command -v just >/dev/null 2>&1 && echo "  [OK] just" || echo "  [FAIL] just not found"
 
-# Audit dependencies for vulnerabilities
+# Audit dependencies for vulnerabilities (no cargo/mix; trivy if present)
 deps-audit:
     @echo "Auditing for vulnerabilities..."
-    # TODO: Replace with your audit command
-    # Examples:
-    #   cargo audit
-    #   mix audit
-    @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true
+    @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || echo "trivy not installed — skip"
     @echo "Audit complete"
 
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -527,10 +523,10 @@ import? "build/just/validate.just"
 # STATE MANAGEMENT
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Update STATE.deed timestamp
+# Attempt to update the timestamp in a key-value-formatted STATE.deed
 state-touch:
     @if [ -f ".machine_readable/descriptiles/STATE.deed" ]; then \
-        sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.deed && \
+        sed -i 's/:last-updated "[^"]*"/:last-updated "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.deed && \
         echo "STATE.deed timestamp updated"; \
     fi
 
diff --git a/build/just/validate.just b/build/just/validate.just
index 66aac2c..4a55d26 100644
--- a/build/just/validate.just
+++ b/build/just/validate.just
@@ -51,15 +51,25 @@ validate-rsr:
     fi
     echo "RSR compliance: PASS"
 
-# Validate STATE.deed syntax
+# Report whether STATE.deed contains key-value metadata and project markers
 validate-state:
-    @if [ -f ".machine_readable/descriptiles/STATE.deed" ]; then \
-        grep -q '^\[metadata\]' .machine_readable/descriptiles/STATE.deed && \
-        grep -q 'project\s*=' .machine_readable/descriptiles/STATE.deed && \
-        echo "STATE.deed: valid" || echo "STATE.deed: INVALID (missing required sections)"; \
-    else \
-        echo "No .machine_readable/descriptiles/STATE.deed found"; \
+    #!/usr/bin/env bash
+    STATE_FILE=".machine_readable/descriptiles/STATE.deed"
+    if [ ! -f "$STATE_FILE" ]; then
+        echo "No $STATE_FILE found"
+        exit 1
+    fi
+    for field in schema-version canonical-name repo-uuid beholding-chora last-updated status phase; do
+        if ! grep -Eq "^[[:space:]]*:${field}[[:space:]]" "$STATE_FILE"; then
+            echo "STATE.deed: INVALID (missing :${field})"
+            exit 1
+        fi
+    done
+    if ! grep -q '^(repo-deed' "$STATE_FILE"; then
+        echo "STATE.deed: INVALID (missing repo-deed form)"
+        exit 1
     fi
+    echo "STATE.deed: valid"
 
 # Validate AI installation guide completeness (finishbot pre-release check)
 validate-ai-install:
diff --git a/ci/README.adoc b/ci/README.adoc
index e5e2944..0c730e1 100644
--- a/ci/README.adoc
+++ b/ci/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.
diff --git a/docs/governance/CRG-AUDIT-2026-09-20.adoc b/docs/governance/CRG-AUDIT-2026-09-20.adoc
index e1accd6..181fc0b 100644
--- a/docs/governance/CRG-AUDIT-2026-09-20.adoc
+++ b/docs/governance/CRG-AUDIT-2026-09-20.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Panoply — CRG Audit (2026-09-20)
 :toc:
@@ -46,7 +46,9 @@ Zig FFI unit+integration; `tests/aspect_tests.sh`, `p2p.sh`, `core_spec.sh`,
 
 === External validation
 
-Zero diverse external targets. Cap **C** is unreachable; **B/A** out of scope.
+Zero diverse external targets. This blocks **B/A** while **C** remains the
+maximum possible grade. C still depends on home-context dogfooding and
+annotation requirements and is separately unmet here for lack of evidence.
 
 == Grade matrix
 
diff --git a/docs/reports/PHASE-11-FINAL.adoc b/docs/reports/PHASE-11-FINAL.adoc
index fec243e..854f577 100644
--- a/docs/reports/PHASE-11-FINAL.adoc
+++ b/docs/reports/PHASE-11-FINAL.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Phase 11 — completeness, CRG/TRG, close-out
 :revdate: 2026-09-20
diff --git a/docs/status/READINESS.adoc b/docs/status/READINESS.adoc
index bf996ca..324ded0 100644
--- a/docs/status/READINESS.adoc
+++ b/docs/status/READINESS.adoc
@@ -170,9 +170,10 @@ Real-world external feedback confirming value. Populate
 
 == 7. Summary (2026-09-20)
 
-* Project grade: **E**. Tests exist; Core does not; RSR D-floor unmet.
+* Project grade: **X**. Tests exist; Core does not; RSR D-floor unmet.
+  FFI / spec surfaces are **E**; they do not lift the project grade.
 * TRG overall: **X** (worst required toolchain component).
-* Delta: X → E after protocol 0–10 (honest promotion, not a product claim).
+* Delta: X → X after protocol 0–10 (FFI / spec surfaces reached E, not the project).
 * Next: D requires C5 + Idris2 CI + STATE test matrix. No product tag.
 
 '''
diff --git a/src/api/README.adoc b/src/api/README.adoc
index 25435ac..d4d3922 100644
--- a/src/api/README.adoc
+++ b/src/api/README.adoc
@@ -2,7 +2,5 @@
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = api
 
-Holding directory required by `rsr-template-repo`.
-Not yet populated with panoply-specific content.
-
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Zig fail-closed adapter: `src/api/zig/adapter.zig` (`NotImplemented` until a
+gateway exists — ROADMAP H8). Not an HTTP product.
diff --git a/tests/e2e/README.adoc b/tests/e2e/README.adoc
index 0adbc8f..363c85a 100644
--- a/tests/e2e/README.adoc
+++ b/tests/e2e/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.
diff --git a/tests/shape/README.adoc b/tests/shape/README.adoc
index 0030505..3374e80 100644
--- a/tests/shape/README.adoc
+++ b/tests/shape/README.adoc
@@ -5,4 +5,4 @@
 Holding directory required by `rsr-template-repo`.
 Not yet populated with panoply-specific content.
 
-TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).
+Holding — see `docs/status/ROADMAP.adoc` (H1). Not a product surface.