docs(handoff): ranks 22 and 25 SHIPPED and VERIFIED LIVE — the deadman's first run absorbed a real flake, no toast

[ZacxDev]

Records that ranks 22 and 25 are now shipped and verified against the real path, not merged-and-hoped.

• Both hosts at 2882d2c7; workbench main-green-check.timer enabled, fired on deploy.
• 🔴 The deadman's FIRST live run exercised every contested design decision: attempt 1 red (dl-router OperationalError('database is locked')), retry, attempt 2 green + cached, verdict flake, exit 0, no toast.
• 🔴 Audit round 1's finding 4 (the cached arm) fired in production on run one — without it nodetests would have been UNMEASURED and laddered to a BLIND toast about a green main.
• The ssh-clone-under-systemd assumption — the one no test in feat(main-green): a deadman that reports a RED main, because nothing else does (rank 22) #1274 could reach, and the one I flagged as my biggest suspicion — is confirmed working (5 s, no agent).
• Two ship.sh non-defects recorded: rc 7 (an uncommitted espanso edit blocked the switch; ship refused rather than stashing) and rc 11 (main moved mid-run, verify compared against its own stale snapshot — the documented rc-19 race surfacing as rc 11).
• Carried forward 3 durable blocks the write gate flagged only 1 of, including the recurring DIRTY-AND-IN-THE-ARTIFACT class: both hosts at the same SHA are not necessarily running the same artifact.

Still open and unchanged: a test hardcoding /tmp/body.md reddens the dev-host tier for everyone whenever another session leaves that file around.

🤖 Generated with Claude Code