decisions/2026-09-30-oauth2-proxy-cookie-collision-fleet.md

@@ -31,7 +31,9 @@ differ, so a future refactor to a constant fails in the renderer's own test.
 
 Re-rendering with the canonical command regenerated **five** goldens, not four. Jackett is the
 fifth, and this is the one thing in this branch the PM brief did not anticipate — see
-"the jackett collision" below.
+"the jackett collision" below. The three `conformance/tests/l1-rendering/*/golden/` fixtures are
+expected-output copies of the same renderer, so they are regenerated too; that is not collateral
+damage, it is the L1 stage doing its job (it FAILED on the first gate run and named the drift).
 
 **The new gate check** is `conformance/tests/l0-static/oauth2-proxy-cookie-names-distinct/`,
 declaring `conformance.home.k3s/scope: whole-repo` so `ci/l0.sh`'s `--include-scope` union runs it
@@ -151,10 +153,17 @@ on its own terms and should be closed rather than rebased.
 ## What I did NOT verify
 
 - **Gate rc 3 (UNDETERMINED), not 0.** Green stages: `decisions-log`, `lint`, `l0`, `render-golden`,
-  `l1`, `approval-policy`. **Skipped:** `spec-immutability` (the sibling spec repo is not mounted —
-  the one tolerated skip), `gitea-settings` (no `SETTINGS_API_TOKEN`), and **L2/L3 conformance**
-  (`CLUSTER_AVAILABLE` unset). Nothing FAILED; nothing runtime was certified either. **rc 3 is
-  UNDETERMINED, never green**, and this branch must not be described as green on the strength of it.
+  `l1`, `approval-policy`. **Skipped:** `spec-immutability` (the sibling spec repo is not mounted
+  at the container's `SPEC_REPO` path from a worktree — the one tolerated skip), `gitea-settings`
+  (no `SETTINGS_API_TOKEN`), and **L2/L3 conformance** (`CLUSTER_AVAILABLE` unset). Nothing FAILED;
+  nothing runtime was certified either. **rc 3 is UNDETERMINED, never green**, and this branch must
+  not be described as green on the strength of it. The touched-requirement subset —
+  `R-GITOPS-02 R-IDP-02 R-IDP-06 R-NET-01 R-NET-05 R-NET-06 R-NET-07 R-PLAT-02 R-TEST-01 R-TEST-02
+  R-TEST-03 R-TEST-04` — is reported **UNVERIFIED** at L2/L3 for all twelve.
+- **`approval-policy` passed vacuously here** (`event='none'` — it is not a pull_request run). On
+  the PR it will REQUIRE a non-author approving review: `infra/gitea/approval-policy.json` lists
+  `conformance/**` as sensitive, because changing the tests changes what green MEANS. That is
+  correct and expected for this branch, not an obstacle to route around.
 - **No browser round-trip. The sign-in fix is UNVERIFIED end-to-end.** Identical to the gap the
   2026-09-29 entry recorded and did not close: the collision has still **never been reproduced in a
   browser**, because reproducing it needs two gated apps visited in one session. Everything here is