docs(source-control): record the promotion seam state after #4588 phases

.changes/source-control/docs-4588-seam-state-closeout-b231a2cb.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- babysit-loop promotion-evidence references record the seam state: the resolver passes credential roots when set, and the remaining gaps are an operator-owned bootstrap, the publisher's deployment and sidecar freshness check, and refused WSL and Windows lanes.

plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md

@@ -1,7 +1,6 @@
 # Promotion-evidence trusted seam. Implementation plan (#4588)
 
-Status: Phases 1 and 2 approved by the owner; Phase 2 is implemented. Phase 3 is unapproved and is
-decided again after Phase 2 lands. Phase 3 is not implemented.
+Which phases have shipped and what remains: [#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588).
 
 Each phase needs the owner's approval before its code changes. This document sets scope and phases;
 Phase 1 does not wire the seam, and Phase 2 does.

plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md

@@ -44,13 +44,10 @@ reports each promotable cell's bound and effective state as the checker printed
 how a cell resolves effective-promoted or demoted. With no compliant bootstrap, a step 0 problem,
 any fail-closed reason, or a helper failure, **every promotable cell resolves
 effective-unpromoted** and autonomous merge stays off for C2/C3 classes regardless of tracked rung.
-Operators keep `--merge human-only` on launch lines; lifting it is the owner's call after Phase 3.
-The resolver runs the checker with a fixed argv and passes no `--credential-roots`
-(`resolve-promotion-evidence.mjs`), so a binding whose L2 proof rests on a filesystem credential
-probe (for example a `$HOME/.netrc` path in the probe transcript) fails closed even with a
-compliant bootstrap; [`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md) lists a
-`--credential-roots` surface as out of scope
-([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)). The unattended
+Operators keep `--merge human-only` on launch lines; lifting it is the owner's call.
+The resolver passes `--credential-roots` to the checker when the operator sets
+`promotion_evidence_credential_roots`; unset, a binding whose L2 proof rests on a filesystem
+credential probe fails closed even with a compliant bootstrap. Remaining work is tracked in [#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588). The unattended
 merge path (`babysit_merge_policy.read_promotion`) additionally refuses any option value or
 settings file the lane can write, so on a single-user
 host user-scope settings never qualify there; only managed settings and surfaces owned by someone
@@ -59,9 +56,8 @@ What an operator supplies for the seam is in
 [`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md), and the lane-start preflight
 in [`cycle-shape.md`](cycle-shape.md) step 0 reports each missing or non-compliant surface by
 option name. The implementation checklist and phased plan are in
-[`promotion-evidence-implementation-plan.md`](promotion-evidence-implementation-plan.md), Phase 2
-implemented and Phase 3 unapproved
-([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)). Whether the
+[`promotion-evidence-implementation-plan.md`](promotion-evidence-implementation-plan.md).
+Whether the
 repository's evidence predicates
 ([`loop-lane-prompts.md`](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/prompts/loops/loop-lane-prompts.md)
 merge-lane copy-blocks) are met is not settled here; the fail-closed table below is how this

prompts/loops/loop-lane-prompts.md

@@ -76,9 +76,10 @@ Leave `{{MERGE}}` at `--merge human-only` unless the target repository's rung
 question has been decided the other way. This repository's tracked rung is
 `c2-mechanical` (unattended auto-merge launches at C2 only, #6202). Keep the
 override
-until #4588 closes its remaining gaps (the checker gets no credential roots,
-no host has an operator-owned bootstrap, and no publisher writes the evidence)
-and the evidence predicate is met (see "C2 auto-merge may lack its
+until #4588 closes its remaining gaps (no host has an operator-owned
+bootstrap, the evidence publisher is not deployed and the resolver does not yet
+check its sidecar's freshness, and WSL or Windows lanes running as the operator
+are refused) and the evidence predicate is met (see "C2 auto-merge may lack its
 promotion evidence" under Known gaps).
 
 ## Per-repository profile