feat: re-freeze at 4df7bc96 + canonical PASSING React frozen-adapter holdout receipt

T019 (run lrapr-t019): the React holdout's frozen-adapter clause closes.

- Re-froze the adapter at recomputed composite 4df7bc96 (commit c695a58; only the
  React subtree moved 9b2af39->972ca801; Angular ca3824d and the three core
  subtrees byte-identical — no cross-lineage drift), with a freeze-history
  supersession record naming the authorized react-cra-process-global reopen
  (chain d9f75ef6 -> 5de7df56 -> 4df7bc96).
- react-cra-process-global stays single-app/experimental (now 12 on the list).
- Published the canonical passing witness-holdout receipt
  (evidence/runs/holdout-react-cypress-rwa/green-2026-08-13, digest 76f0b5bd,
  frozenAdapterFingerprint=4df7bc96) and verified it independently offline.
- Regenerated the trust render artifacts offline; trust:verify --offline valid.
- Board: T019 done; T020 owner-directed skeptical audit done — all seven claims
  independently re-verified from primary evidence (freeze math recomputed by hand,
  receipt/trust verifies re-run, parity JSON internal consistency, frozen-subtree
  genericity grep, additive-only test diffs, byte-identity of measured vs frozen
  adapter oid 972ca80); T018 (Angular holdout) activated with its freeze
  expectation repinned to composite 4df7bc96 + unchanged Angular oid ca3824d.

Gate: tsc / vp lint / vp test --project node 2224/2224 / trust:verify --offline valid.

Claude-Session: https://claude.ai/code/session_01HEVhWgWk9AXTiFMysQNB5r

Author: thejackshelton

evidence/runs/holdout-react-cypress-rwa/green-2026-08-13/receipt.json

@@ -0,0 +1,162 @@
+{
+  "schemaVersion": "versionless.holdout-react-cypress-rwa-witness.v1",
+  "role": "holdout",
+  "holdoutOutcome": "passed",
+  "kind": "witness-journey-under-frozen-adapter",
+  "unit": "lrapr-t019/u1-refreeze-rerun-publish",
+  "fixture": "react-cypress-rwa",
+  "application": "cypress-realworld-app",
+  "framework": "react",
+  "supersedes": {
+    "receipt": "evidence/runs/holdout-react-cypress-rwa/rerun-2026-08-12/receipt.json",
+    "note": "Advances the T017 RED re-run by reference; the tranche-one and T017 FAIL records stay immutable and published."
+  },
+  "source": {
+    "repository": "https://github.com/cypress-io/cypress-realworld-app",
+    "ref": "refs/tags/v1.0.18",
+    "revision": "f6b5cf3a1799998dab71181eeed59460f8ada5f4",
+    "archiveSha256": "bd9319272dabc1e7263a0186e0aaae011f6219e6e106363d2c89426f9357b315",
+    "frontendRoot": ".",
+    "license": "MIT",
+    "react": "17.0.2",
+    "reactScripts": "4.0.3",
+    "webpack": "4.44.2",
+    "typescript": "4.3.4"
+  },
+  "runEvidence": [
+    {
+      "path": "evidence/runs/react-cypress-rwa/two-lane-parity.json",
+      "sha256": "689952c7216b562bf3df52516683aa2e15aff3beb393a2c1654d03d967b50288"
+    },
+    {
+      "path": "evidence/runs/react-cypress-rwa/green-2026-08-13/build-profile.json",
+      "sha256": "f831eba3f19d1e401aa14f6c64dbfe93aa08fd1fa55a363d6c062d9cc79762f5"
+    }
+  ],
+  "frozenAdapter": {
+    "composition": "createCraViteAdapter applied through fixtures/react-cypress-rwa/vite.config.ts, nothing holdout-specific in the config",
+    "compositeFingerprint": "4df7bc961033fc5856b4d58e0bca9f11ad2aa9d43aaaee726956f34d209b37e7",
+    "subtrees": [
+      {
+        "path": "packages/frameworks/react",
+        "treeOid": "972ca80155bbc2a6eb3779943cd481b71d35e803"
+      },
+      {
+        "path": "packages/frameworks/angular",
+        "treeOid": "ca3824d0595d1fa88d37feda6b1785dfd79e72c4"
+      },
+      {
+        "path": "packages/core/src/migrations",
+        "treeOid": "5237ce5990af3623206bcd2301047a59c80731cf"
+      },
+      {
+        "path": "packages/core/src/bundlers",
+        "treeOid": "cec2f0b56fbb7897f38d579be805e19982380ca6"
+      },
+      {
+        "path": "packages/core/src/analysis",
+        "treeOid": "262dc8b7528c92883c2300914eb7d42579fb856b"
+      }
+    ],
+    "recomputedByThisUnit": true,
+    "bytesChanged": 0,
+    "changesProposedAndExecuted": 0,
+    "reopenInThisUnit": false,
+    "redBuildPatchedAround": false,
+    "genericCapabilitiesOnly": true,
+    "holdoutSpecificConfiguration": "none"
+  },
+  "migratedBuild": {
+    "result": "green",
+    "bundler": "rolldown 1.0.3 under vite 8.0.16",
+    "attempts": 2,
+    "deterministic": true,
+    "modulesTransformed": 10182,
+    "transformPhase": "complete",
+    "emit": "complete",
+    "outputFiles": 18,
+    "outputDigest": "7051b8489abcaea1bd18ae99a082acf0c8d88596f1dfd82d6b4bac222e37dc18"
+  },
+  "journey": {
+    "behaviorDigest": "963785426eb0c56e8d2f929b5462d35e9a7a8d123fa9d8d01a765c6cb35ebe26",
+    "behaviorParity": true,
+    "lanesAreDistinctBuilds": true,
+    "passesPerLane": 2,
+    "lanes": {
+      "baseline": {
+        "lane": "baseline",
+        "legs": {
+          "ok": 51,
+          "total": 51
+        },
+        "semanticDigest": "5c3285f1c402920f358bed9cacedaac07d3ed4800251ed264f20a3f0030d49cf",
+        "behaviorDigest": "963785426eb0c56e8d2f929b5462d35e9a7a8d123fa9d8d01a765c6cb35ebe26",
+        "deterministic": true,
+        "laneStaticFiles": 84,
+        "laneStaticDigest": "57cea24966c61963914da814e8348c970f11468127228c070def6c6472980028"
+      },
+      "migrated": {
+        "lane": "migrated",
+        "legs": {
+          "ok": 51,
+          "total": 51
+        },
+        "semanticDigest": "54313316fef5eac37d098a207bd1f140805f68b126291e62a69f99a75981e6ed",
+        "behaviorDigest": "963785426eb0c56e8d2f929b5462d35e9a7a8d123fa9d8d01a765c6cb35ebe26",
+        "deterministic": true,
+        "laneStaticFiles": 18,
+        "laneStaticDigest": "13f71830eb0fc79b37c546c59f5437d3c3b381c7e87ed8ebd844f8d1f6a95897"
+      }
+    },
+    "navigations": [
+      "/signin",
+      "/",
+      "/user/settings",
+      "/transaction/new",
+      "/",
+      "/personal",
+      "/",
+      "/contacts",
+      "/personal",
+      "/notifications"
+    ],
+    "trackedEventCounts": {
+      "click": 16,
+      "input": 232,
+      "change": 15,
+      "keydown": 232,
+      "mouseover": 27
+    },
+    "successfulNonLoopback": 0,
+    "mockedNonLoopback": 17,
+    "backendCategorySize": 11
+  },
+  "determinism": {
+    "reseededFromSnapshotBeforeEachPass": true,
+    "mintedValuesPlaceholdered": true,
+    "passTwiceSemanticDigestStable": true
+  },
+  "locality": {
+    "mode": "live-loopback-backend",
+    "successfulNonLoopback": 0,
+    "osWideIsolation": false
+  },
+  "counting": {
+    "legsPerLane": 51,
+    "lanesMeasured": 2,
+    "passesPerLane": 2,
+    "countedInLineageNumerator": false,
+    "countingNote": "This holdout passed, and it is still counted in no lineage numerator: a passing holdout shows the frozen adapter carrying one further application, not a migrated-application product count. It is published rather than folded into any numerator."
+  },
+  "nonclaims": [
+    "This is a holdout, not a certification: it shows the frozen adapter carrying one further application end to end, not generic support.",
+    "It is counted in no lineage numerator. A holdout that passes is still evidence about the adapter, not a migrated-application count.",
+    "Build-level byte parity across the two lanes is not claimed: the two production bundles are genuinely distinct builds, which is exactly what makes the behaviour parity non-trivial. The only per-lane fact is each lane’s own bundle byte identity, kept out of the shared behaviour digest by construction.",
+    "Nothing is claimed about the four external auth provider modes; only the local passport-local mode is exercisable offline and only it was exercised.",
+    "The live loopback backend is the application’s own Express-over-lowdb server, re-seeded from its frozen snapshot before every pass and held out of the byte inventory; the frontend SPA dist is byte-identical before and after each pass."
+  ],
+  "integrity": {
+    "algorithm": "sha256",
+    "canonicalDigest": "76f0b5bd0d8a3fa0596d3c5d190c764ee7402f4e5c27870d36bdb3fa5f04a73e"
+  }
+}

evidence/runs/holdout-react-cypress-rwa/green-2026-08-13/receipt.md

@@ -0,0 +1,37 @@
+# cypress-realworld-app — holdout PASS receipt (re-run under the frozen adapter)
+
+- Outcome: **passed** — the frozen adapter carries this application at this revision, end to end
+- Kind: witness-journey-under-frozen-adapter
+- Canonical SHA-256: 76f0b5bd0d8a3fa0596d3c5d190c764ee7402f4e5c27870d36bdb3fa5f04a73e
+- Unit: `lrapr-t019/u1-refreeze-rerun-publish`
+- Advances by reference: `evidence/runs/holdout-react-cypress-rwa/rerun-2026-08-12/receipt.json` — Advances the T017 RED re-run by reference; the tranche-one and T017 FAIL records stay immutable and published.
+- Source: https://github.com/cypress-io/cypress-realworld-app at `refs/tags/v1.0.18` (`f6b5cf3a1799998dab71181eeed59460f8ada5f4`, MIT), create-react-app 4.0.3 over webpack 4.44.2, React 17.0.2, TypeScript 4.3.4
+- Frozen adapter fingerprint: `4df7bc961033fc5856b4d58e0bca9f11ad2aa9d43aaaee726956f34d209b37e7` over 5 subtrees, recomputed by this unit; adapter bytes changed: 0; reopened in this unit: false
+- Derived from committed run evidence: `evidence/runs/react-cypress-rwa/two-lane-parity.json` (`689952c7216b562bf3df52516683aa2e15aff3beb393a2c1654d03d967b50288`), `evidence/runs/react-cypress-rwa/green-2026-08-13/build-profile.json` (`f831eba3f19d1e401aa14f6c64dbfe93aa08fd1fa55a363d6c062d9cc79762f5`)
+
+## The migrated build under the frozen adapter
+
+createCraViteAdapter applied through fixtures/react-cypress-rwa/vite.config.ts, nothing holdout-specific in the config — **green**, rolldown 1.0.3 under vite 8.0.16, 2 attempts, deterministic: true. 10182 modules transformed (transform complete, emit complete), 18 output files, output digest `7051b8489abcaea1bd18ae99a082acf0c8d88596f1dfd82d6b4bac222e37dc18`.
+
+## The measured journey — two lanes, twice each, live loopback backend
+
+- Behaviour digest (shared across both lanes and both passes): `963785426eb0c56e8d2f929b5462d35e9a7a8d123fa9d8d01a765c6cb35ebe26` — two-lane behaviour parity: true, over genuinely distinct builds: true
+- Baseline lane: 51/51 legs, semantic digest `5c3285f1c402920f358bed9cacedaac07d3ed4800251ed264f20a3f0030d49cf` (deterministic across 2 passes), 84 SPA files, bundle digest `57cea24966c61963914da814e8348c970f11468127228c070def6c6472980028`
+- Migrated lane: 51/51 legs, semantic digest `54313316fef5eac37d098a207bd1f140805f68b126291e62a69f99a75981e6ed` (deterministic across 2 passes), 18 SPA files, bundle digest `13f71830eb0fc79b37c546c59f5437d3c3b381c7e87ed8ebd844f8d1f6a95897`
+- Recorded navigations: `/signin` → `/` → `/user/settings` → `/transaction/new` → `/` → `/personal` → `/` → `/contacts` → `/personal` → `/notifications`
+- Locality: successful non-loopback requests: 0; mocked non-loopback (in-context avatar SVGs): 17; live-backend category endpoints: 11
+
+## Determinism and locality
+
+- Re-seeded from the frozen snapshot before every pass: true; minted values placeholdered: true; pass-twice semantic digest stable: true
+- Locality mode: live-loopback-backend; successful non-loopback: 0; OS-wide isolation: false
+
+## Counting and non-claims
+
+Legs per lane: 51; lanes measured: 2; passes per lane: 2; counted in lineage numerator: false. This holdout passed, and it is still counted in no lineage numerator: a passing holdout shows the frozen adapter carrying one further application, not a migrated-application product count. It is published rather than folded into any numerator.
+
+- This is a holdout, not a certification: it shows the frozen adapter carrying one further application end to end, not generic support.
+- It is counted in no lineage numerator. A holdout that passes is still evidence about the adapter, not a migrated-application count.
+- Build-level byte parity across the two lanes is not claimed: the two production bundles are genuinely distinct builds, which is exactly what makes the behaviour parity non-trivial. The only per-lane fact is each lane’s own bundle byte identity, kept out of the shared behaviour digest by construction.
+- Nothing is claimed about the four external auth provider modes; only the local passport-local mode is exercisable offline and only it was exercised.
+- The live loopback backend is the application’s own Express-over-lowdb server, re-seeded from its frozen snapshot before every pass and held out of the byte inventory; the frontend SPA dist is byte-identical before and after each pass.

evidence/trust/current/adapter-freeze.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": "versionless.trust.v1",
   "freeze": {
-    "commit": "cce34175340273919c0b70341dfada5533f0307c",
+    "commit": "c695a586d5e58f5abda9f3684f60cc803b1ebf22",
     "algorithm": "sha256",
-    "composite": "5de7df565fb8e445a45f9f8f43eac27b80b71189d59e4df243e93471406a260c",
+    "composite": "4df7bc961033fc5856b4d58e0bca9f11ad2aa9d43aaaee726956f34d209b37e7",
     "preimage": "newline-terminated `<path> <tree-oid>` lines in the listed subtree order",
     "subtrees": [
       {
         "path": "packages/frameworks/react",
-        "treeOid": "9b2af393179749a4093f46e587e7f4fd9ce09b47"
+        "treeOid": "972ca80155bbc2a6eb3779943cd481b71d35e803"
       },
       {
         "path": "packages/frameworks/angular",
@@ -30,10 +30,10 @@
     "state": "frozen",
     "claim": "The migration engine adapter surface is byte-stable at this commit.",
     "supersedes": {
-      "composite": "d9f75ef677cb850f664cc188abf77b8ebfd24e84cb58d147b74e9bbaa143eb77",
-      "commit": "57b308a573dd582c844ce401fb1161cd70e9bc66",
+      "composite": "5de7df565fb8e445a45f9f8f43eac27b80b71189d59e4df243e93471406a260c",
+      "commit": "cce34175340273919c0b70341dfada5533f0307c",
       "state": "superseded",
-      "reopenReason": "T999 audit: the tranche-one d9f75ef6 freeze was falsified for cypress-realworld-app holdout carriage (missing non-UTF-8 module source decoding). The adapter surface was reopened behind a new Judge freeze boundary and re-frozen at composite 5de7df56 once the follow-on tranche landed."
+      "reopenReason": "Authorized react-cra-process-global capability reopen for cypress-realworld-app holdout carriage (owner-directed 2026-08-13): under the 5de7df56 freeze the migrated Vite bundle threw `process is not defined`, so a generic analyzer-driven process/browser-parity shim was added to packages/frameworks/react and the adapter was re-frozen at composite 4df7bc96. Only the React subtree moved; Angular, migrations, bundlers, and analysis stayed byte-identical. 5de7df56 had itself superseded the tranche-one d9f75ef6 freeze (commit 57b308a)."
     }
   },
   "holdoutPublishing": {
@@ -67,6 +67,10 @@
           "lineage": "react",
           "capability": "composed-migration"
         },
+        {
+          "lineage": "react",
+          "capability": "react-cra-process-global"
+        },
         {
           "lineage": "angular",
           "capability": "custom-webpack-absorption"

evidence/trust/current/manifest.json

@@ -1,18 +1,18 @@
 {
   "schemaVersion": "versionless.trust.v1",
-  "canonicalDigest": "45955055e02583b02af713388a34438fa8c8ca579aee9e1e3339fcdfda59908a",
+  "canonicalDigest": "85539a164179e91f24e573137d5e8240c7c845f969163faee82d393654d591fe",
   "integrity": {
     "algorithm": "sha256",
     "authenticity": "not-established",
     "certification": "not-claimed"
   },
   "deterministicCore": {
     "algorithm": "sha256",
-    "digest": "8ab35ddbb13e9c2cdcf7f6d40c80a1eeafe73f74099d6f430ebbac5dc445c221",
+    "digest": "0de7e22856debb11a8766f77818d0a9518eeeb6e024a5989c394196afe647ff1",
     "artifacts": [
       {
         "path": "adapter-freeze.json",
-        "sha256": "b493b777cdc12908442038d181fa82a0982380d8d18556b337c49aeaf804c634"
+        "sha256": "b7dc84b440e99acb47193db212a19e18d1742864a0f01f3b4c4ed88348db5ff6"
       },
       {
         "path": "dependency-graph.cdx.json",
@@ -24,7 +24,7 @@
       },
       {
         "path": "vulnerabilities.json",
-        "sha256": "41df8f77d3406dd7942e9453233a63fbacac86a97eb8c48ddbfe1ab98114d007"
+        "sha256": "6a9ec422e9ada79e49d0d2c557fa876140891b3b8abd4bb5d30de06991dadad6"
       },
       {
         "path": "provenance.json",
@@ -56,7 +56,7 @@
       },
       {
         "path": "capability-coverage.json",
-        "sha256": "05c003b0335b1ccf55e7f40eb086f7e0f2d1efc125607adf687e82b464c3e998"
+        "sha256": "1db745dcb3b32d3d8640577c3c3a83d6c3d29fbe7ea6ec802a0c00b1e7fd30d8"
       }
     ]
   },
@@ -225,8 +225,8 @@
     }
   ],
   "observation": {
-    "generatedAt": "2026-08-12T21:28:24.448Z",
-    "vulnerabilityFreshness": "verified"
+    "generatedAt": "2026-08-14T00:36:08.453Z",
+    "vulnerabilityFreshness": "stale"
   },
   "derivedReport": "report.md"
 }