Phase 8D validation completed

docs/phase8d_plan.md

@@ -1,6 +1,6 @@
 # Phase 8D — Incremental web administration plan
 
-Status: **8D.0 documentation/source audit and baseline build and user-provided runtime memory baseline recorded; remaining target evidence and runtime budgets pending. 8D.1–8D.22 remain planned.** See the [8D.0 baseline and M1 contract](phase8d_baseline.md); no authentication implementation is claimed.
+Status: **8D.0 validated by user sign-off on 2026-09-05; 8D.1 internal session primitives implemented, host-tested and build-verified, with target validation pending. Reserve budgets remain pending. 8D.2–8D.22 remain planned.** See the [8D.0 baseline and M1 contract](phase8d_baseline.md); no authentication implementation is claimed.
 
 This is the execution plan for [roadmap Phase 8D](roadmap.md#phase-8--role-based-users-and-administrative-access). The roadmap retains the feature/security requirements; this document defines small work units, dependencies, and release gates. The [administration test matrix](user_administration_tests.md#planned-phase-8d-integrated-web-administration) remains the final acceptance checklist.
 
@@ -58,7 +58,7 @@ After each runtime-changing chunk: build; boot and read UART0 status/`memory`; l
 
 **Gate:** Existing admin and user browser login, serial data, USB, and SSH work; baseline `pio run` and target memory evidence are recorded. If the rolled-back baseline already fails login, diagnose that in a separate task before changing authentication. If target evidence is unavailable, the budget and runtime gate remain pending.
 
-**Record:** [8D.0 baseline, browser contract, resource inventory and target checklist](phase8d_baseline.md). The baseline build passed at 94,532 B linked RAM / 1,599,973 B flash; no device ports were available. A user-provided runtime memory baseline is now recorded for one web serial writer plus user/admin SSH sessions. Other workload measurements, reserve floors and incremental budgets remain pending. Do not treat the documented contract as implemented behavior.
+**Record:** [8D.0 baseline, browser contract, resource inventory and target checklist](phase8d_baseline.md). **Validated by user sign-off on 2026-09-05**, with tested source identified as `d8999cd4a96e477fabd392ced02d810c3cd22d0f`. Historical baseline build: 94,532 B linked RAM / 1,599,973 B flash. User-provided boot, browser, lifecycle, mixed-client and 15-minute soak/60-second cleanup samples include heap and SSH stack measurements. The user attributes SSH I/O errors to out-of-spec 460400-baud testing; see sign-off for distinction from reported UART configuration. Numeric reserve floors and incremental budgets remain open, without blocking user-approved 8D.0 closure. Do not treat the documented contract as implemented behavior.
 
 ### 8D.1 — Bounded server-side session primitives, not yet browser-facing
 
@@ -68,6 +68,8 @@ After each runtime-changing chunk: build; boot and read UART0 status/`memory`; l
 
 **Gate:** Focused local/component checks for lifecycle, capacity, slot reuse, stale principals, and failed initialization; bounded storage accounting and build. Existing Basic-auth behavior remains unchanged. If no executable harness is practical, distinguish code review from target execution and carry the missing checks into 8D.3; do not claim unused code was exercised by a boot test.
 
+**Record:** Implemented `web_session_store` plus admitted-start/stop lifecycle hooks; no route uses it yet. `python3 tests/web_session_store/run.py` and `pio run` pass. Linked RAM **95,204 B (+672 B)**, flash **1,600,505 B (+532 B)** versus 8D.0; static store/lock symbols total 664 B, no module heap allocation/new task/routes/sockets. Only init/stop are currently retained in the firmware link; host tests exercise the full production module. See the [8D.1 implementation record](phase8d_baseline.md#8d1-implementation-and-validation-record) for exact accounting, review limits and post-change target checklist. User explicitly requested this chunk with reserve gates pending; post-change device regression remains pending. Stop before 8D.2.
+
 ### 8D.2 — Bind existing serial tickets and sockets to a web-session identity
 
 **Start in:** `src/web_serial_transport.{c,h}`, `src/web_server.{c,h}`, the session module from 8D.1, and the existing revocation call sites in `src/user_console.c`.
@@ -155,11 +157,11 @@ Update the roadmap and user/command documentation to distinguish completed featu
 
 ## Progress and next-request template
 
-Progress: **8D.0 documentation/source audit and build complete; target validation and numeric runtime budgets pending. 8D.1–8D.22 planned.** Record incremental results in `docs/agent/current-state.md`, retaining the [baseline](phase8d_baseline.md) and cumulative resource measurements as work proceeds. User-provided web/SSH status and memory evidence is recorded in the baseline; the full target/browser acceptance checklist remains unverified.
+Progress: **8D.0 validated by user sign-off; 8D.1 implemented / host-tested / build-verified, not target-verified. Reserve gates pending. 8D.2–8D.22 planned.** Record incremental results in `docs/agent/current-state.md`, retaining the [baseline](phase8d_baseline.md) and cumulative resource measurements as work proceeds. The baseline records user-provided evidence and sign-off; this does not imply completion of later browser-authentication acceptance checks.
 
 Suggested next request:
 
-> Work on Phase 8D.0 only, following `docs/phase8d_plan.md`. Establish the rolled-back baseline, the minimal M1 authentication/browser contract, and the resource budget. Do not implement authentication, import the experimental branch, or proceed to 8D.1. Report missing hardware evidence as pending and stop with the exact validation checklist.
+> Validate the Phase 8D.1 target regression checklist in `docs/phase8d_baseline.md` and record post-change memory alongside the two pre-change samples. Then work on 8D.2 only when that checkpoint is satisfied, or explicitly decide to proceed with it pending. Do not cut over browser authentication or continue to 8D.3.
 
 For later chunks: