docs: mark JSON/YAML locally gated and public

Record the green logged workspace sweep, final diff audit, and matching
public/checkpoint head 5c202c5. Pin PR #123's full head OID and fresh CI
run so any machine can resume at CI or review without reconstructing
local state.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

docs/active-work.md

@@ -55,14 +55,15 @@ If it does not, stop and repair the remote/fetch configuration.
 
 - PR: <https://github.com/levineuwirth/pmacs/pull/123>
 - Public PR branch: `githubsucks/json-yaml-grammar`
-- Public PR head before the transfer checkpoint: `4be2a65`
+- Public PR head: `5c202c5`
-- Original merge base: `56eb67e`; current main is nine commits ahead.
+- Original merge base was `56eb67e`; the completed branch is rebased onto
+  canonical main `f8096ff`.
 - Portable checkpoint branch:
   `githubsucks/json-yaml-handoff-2026-07-20`
 - Checkpoint head: `5c202c5`
 - The checkpoint is a continuation branch for recovery, not a second
-  feature and not a merge target. Finish there, then push its completed
+  feature and not a merge target. Its completed head now exactly matches
-  head to `githubsucks/json-yaml-grammar`.
+  `githubsucks/json-yaml-grammar`.
 
 The checkpoint carries the transferred review-fix set plus the completed
 destination-machine continuation:
@@ -119,14 +120,22 @@ Verification completed across the source and destination machines:
     real JSON and real YAML tests both ran and passed;
   - `PMACS_REQUIRE_GPU=1 cargo test -p pmacs-gpu`: 102 passed against a
     real GPU device.
+- `cargo test --workspace -- --skip basedpyright` passed as one
+  pipefail-protected invocation with both pinned providers on PATH; its
+  complete machine-local log is
+  `/tmp/pmacs-json-yaml-workspace-5c202c5.log`, and the log confirms both
+  live provider tests ran and passed.
+- Final-head `cargo fmt --check`, `git diff --check`, and clean-worktree
+  audit passed.
+- The completed head was pushed to `githubsucks/json-yaml-grammar` with
+  an exact force-with-lease. PR #123 is open against `main` at full OID
+  `5c202c54c19c05b0824812a578463ec082810981`; fresh CI run
+  `29778967156` was created for that head.
 
 Still required:
 
-1. Run the final one-invocation workspace sweep with basedpyright skipped,
+1. Let CI run `29778967156` finish and address any findings.
-   retain its full log, then run `git diff --check`.
+2. Await user review. Never merge without the user's instruction.
-2. Push the completed head to `githubsucks/json-yaml-grammar`; confirm
-   new PR checks belong to that head. Never merge without the user's
-   instruction.
 
 Provider setup is intentionally machine-local:
 

docs/agent-handoff.md

@@ -139,14 +139,13 @@ commands, read `docs/active-work.md` immediately after this file.
   `StatuslineSegments` channel; the existing LSP status tracker is the
   first built-in provider. Approval → implementation → gates → PR.
   Completing stage 3 completes Arc 4.
-- **OPEN: JSON + YAML PR #123.** The public PR branch still points to
+- **OPEN: JSON + YAML PR #123.** Public and checkpoint branches both
-  the original two-commit implementation (`4be2a65`). Review fixes and
+  point to fully gated `5c202c5`, rebased onto `f8096ff`. Review fixes
-  both live-provider paths are preserved on checkpoint branch
+  include config push delivery, corrected provider/config claims, and
-  `json-yaml-handoff-2026-07-20`; the real YAML-through-pmacs smoke now
+  both live-provider paths; the real YAML-through-pmacs smoke proves
-  proves auto-attach, network-free configuration, diagnostics, and
+  auto-attach, network-free configuration, diagnostics, and continued
-  continued liveness against Red Hat 1.24.0. The checkpoint is rebased
+  liveness against Red Hat 1.24.0. Fresh CI is running for the exact
-  onto `f8096ff`; full gates remain. Do not mistake the PR's old green
+  public head; awaiting CI and user review. Exact recovery is in
-  CI for validation of the checkpoint. Exact recovery is in
   `docs/active-work.md`.
 - **PARKED: kill-ring browser + persistence.** Revision 2 framing is
   preserved on branch `kill-ring-browser`, but its `0efb5cd` scout is