Record server-only custody correction and remaining initial proposal

doc/plans/2026-10-26-chat-catalog-eval-progress.md

@@ -233,3 +233,9 @@ All 227 concrete lazy exports and 2 legacy definitions were reconciled from the
 Source diagnosis: the owned Docker helper registers its generated password and connection string as protected roots; normal server configuration intentionally stores that connection string in the private disposable config; the generic persisted-home scan has no corresponding narrowly validated custody handling. This identifies a shared harness custody conflict, pending manager review; it does not establish a product or model leak. Further admissions stopped and the other three selected cases remain unreserved. Exact result: `tests/runner-e2e/results/catalog-initial-2026-10-27T07-03-53-222Z-projects-create-project/chat-features/runner-codex-subscription/local/projects.create-project/attempt-1/result.json`.
 
 Cleanup passed; actual database identity reports the exact pinned PostgreSQL 18.6 artifact and container status `removed`. Actual heartbeat usage is **704,239 total tokens including cache** across two runs; subscription dollars remain unpriced. No imported fixture cost events were included. Original earlier failures and cleanup overlays remain unchanged.
+
+### Docker custody correction and remaining-three proposal
+
+The authorized harness-only correction `96058c7e2f5364342917ebeb598089b5195330d9` uses the existing product-supported server `DATABASE_URL` configuration. Seeded Docker config contains no DSN; only the exact receipt-validated server child environment receives it. Ambient URLs remain scrubbed, actual native Codex environment projection excludes both database variables, and the persisted-state scanner is unchanged. Controls reject an arbitrary server URL, undeclared override, persisted DSN, a DB password elsewhere in config, and unrelated provider credentials. The project initial remains failed; no postprocessing changes its outcome or consumes its held final-B retry.
+
+New immutable remaining-three candidate: `f73390f925edcddd3af977e337adf16d5818fb41`, parent `6951f67ecd1aaedec789703dc9c7227bddd2b59a`, with only the six custody paths overlaid. Actual archived E2E typecheck exited 0; 109 targeted controls across four files passed. Production sources/lock still exactly match baseline `8373d7867963674ff960d2345d0d28086f799bc7`; 46 dependency links and copied build/native bytes match prior audited immutable receipts. Read-only Docker preflight confirms the same qualified engine and installed PostgreSQL 18.6 digest. Three fresh case fingerprints and name-only private-input replay receipts are in `results/chat-catalog-campaign/initial-selection-f73390f925.json`; scoped control/provenance summary is `custody-correction-f73390f925.json`. Comment-with-reference, broken-link and edit-profile remain unreserved pending manager admission. No new bootstrap, model/provider calls, canonical launches or reservations occurred during correction.