docs(p10.5): live shared-service smoke verified end-to-end May 23, 2026

Previously P10.5 was marked complete with a deferral note because the
sibling services (platform-service 4003, extraction-service 4005,
mcp-server 4007) were not running on the audit host. Today they are
all running, so I executed the smoke and confirmed it passes.

Command:
  JWT_SECRET="dev-secret-change-me-at-least-32-characters-long" \
    bash scripts/local-smoke.sh

Output (exit 0, 11 ok lines):
  info: starting NoteLett backend in memory mode
  ok: NoteLett backend started at http://localhost:4016
  ok: NoteLett health
  ok: NoteLett bootstrap
  ok: platform-service health
  ok: extraction-service health
  ok: mcp-server health
  ok: authenticated workspace create
  ok: authenticated note create
  ok: authenticated note read
  ok: smoke cleanup attempted
  ok: local production-readiness smoke passed

Updates:
- §Post-Sprint-A Re-verification: replaces the blanket deferral note
  with the actual verification details for live shared-service smoke
  and a separate, narrower deferral note for Docker compose smoke
  (which still fails on corp-network hosts due to TLS interception in
  the backend/Dockerfile npm install step but succeeds on CI).
- §P10.5: replaces the historical deferral text with today's
  end-to-end verification result.

docs/PRODUCTION_READINESS_HANDOFF_ROADMAP.md

@@ -20,7 +20,8 @@ Re-verified gates on May 22, 2026:
 - `pnpm run verify` passes: backend 373/373 tests (54 files), web 96/96 tests (22 files), mobile 97/97 tests (25 files), backend build, web build.
 - Backend lint, web lint, mobile lint all exit 0 (advisory warnings retained).
 - `pnpm run audit:release-guards` passes secret scan and color/token audit.
-- Docker compose smoke and live shared-service smoke remain explicit environment deferrals on this host.
+- Live shared-service smoke **verified May 23, 2026** — `pnpm run smoke:local` passed end-to-end against live `platform-service` (4003), `extraction-service` (4005), and `mcp-server` (4007). Covered: NoteLett `/health`, `/api/bootstrap`, three sibling-service `/health` checks, authenticated workspace create, authenticated note create + read, smoke cleanup. Output: 11 `ok:` lines, exit 0.
+- Docker compose smoke remains environment-deferred: the `scripts/compose-smoke.sh` script and `docker-compose.yml` are validated (bash syntax + `docker compose config` parse) but the actual image build fails on corporate-network hosts due to TLS interception of `https://registry.npmjs.org` during `npm install -g pnpm@10.6.5` in `backend/Dockerfile`. The job runs successfully on CI (no TLS interception) and on any host without corporate proxy. Tracked in [`docs/NEXT_SPRINT_ROADMAP.md`](NEXT_SPRINT_ROADMAP.md) under Sprint B environment deferrals.
 
 ## Current Baseline
 
@@ -263,7 +264,7 @@ Goal: prove the product is ready to release.
 - [x] **P10.2** Run lint for backend, web, and mobile. Commit: `9bded74`; Verified: `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/backend run lint'`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/web run lint'`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/mobile run lint'`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/backend run typecheck'`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/web run typecheck'`; `git diff --check`. Added the missing backend `@eslint/js` dev dependency, converted empty Palace extension interfaces to type aliases, and downgraded web React compiler advisory rules to warnings so lint still surfaces them without failing the final gate. Backend lint exits 0 with 14 warnings, web lint exits 0 with 21 warnings, and mobile lint exits 0 with 30 warnings.
 - [x] **P10.3** Run web Playwright E2E. Commit: `5e38496`; Verified: `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/web exec playwright test e2e/release-flows.spec.ts --reporter=list --workers=1'` passed 4 release-flow specs: dashboard note creation and URL intake, note edit/archive/restore/link/prompt flow, review approve/reject flow, and settings/public share smoke. Notes: the web server emitted the existing `NO_COLOR`/`FORCE_COLOR` warning and the existing Next `--localstorage-file` warning without failing.
 - [x] **P10.4** Run Docker compose build and smoke. Commit: `ea5bd4f`; Verified: `bash -n scripts/compose-smoke.sh`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; docker --version; pnpm run smoke:compose'` reached `pnpm run smoke:compose` but failed before build/start because this host has no Docker-compatible runtime (`zsh:1: command not found: docker`; `docker is required for compose smoke checks.`). This is an explicit environment deferral; live compose build/smoke remains delegated to a Docker-capable runner using the already-added `scripts/compose-smoke.sh`.
-- [x] **P10.5** Run common-platform dependency smoke with platform-service, extraction-service, and mcp-server available. Commit: `5603726`; Verified: `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; export COMMON_PLAT_DIR=/Users/saravana/BytelystAI/learning_ai/learning_ai_common_plat; pnpm run smoke:local'` started NoteLett in memory mode and passed backend `/health` plus `/api/bootstrap`, then failed because `platform-service` was unavailable on `localhost:4003`; direct non-Docker startup from `learning_ai_common_plat` also failed because this shell lacks required `COSMOS_ENDPOINT` and `COSMOS_KEY` values. This is an explicit dependency-environment deferral; the smoke script remains ready for a host with platform-service, extraction-service, mcp-server, and Cosmos credentials available.
+- [x] **P10.5** Run common-platform dependency smoke with platform-service, extraction-service, and mcp-server available. **Verified end-to-end May 23, 2026** on a host with all three sibling services running. Command: `JWT_SECRET="dev-secret-change-me-at-least-32-characters-long" bash scripts/local-smoke.sh`. Output (11 lines, exit 0): NoteLett backend started in memory mode → `/health` ok → `/api/bootstrap` ok → platform-service health ok → extraction-service health ok → mcp-server health ok → authenticated workspace create ok → authenticated note create ok → authenticated note read ok → smoke cleanup attempted ok → `local production-readiness smoke passed`. Historical commit `5603726` previously deferred this because the sibling services were not running on that host; the script itself was already correct and is now confirmed by live execution.
 - [x] **P10.6** Run hardcoded color/token audit, secret scan, and API URL/product ID drift audit. Commit: `a6c0003`; Verified: `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; export COMMON_PLAT=/Users/saravana/BytelystAI/learning_ai/learning_ai_common_plat; pnpm run audit:release-guards'` passed common-platform secret scan plus hardcoded color/token checks; `rg -n "localhost:40(10|11|12|13|14|15)|bytelyst-notes|ByteLyst Agentic Notes" .github AGENTS.md README.md backend web mobile shared docs --glob '!docs/ARCHITECTURE_REVIEW_AND_REUSE_ROADMAP.md' --glob '!docs/GAP_ANALYSIS.md' --glob '!docs/AGENT_TASK_ROADMAP.md' --glob '!docs/roadmaps/**'` returned no active drift; URL audit confirmed expected NoteLett/common-platform local defaults on ports 3000, 4003, 4005, 4007, and 4016. Updated active GitHub Copilot instructions from the old scaffold identity to NoteLett/`productId: "notelett"` and `pnpm run verify`.
 - [x] **P10.7** Update `docs/ROADMAP.md`, `AGENTS.md`, `README.md`, and this document with final status, commit hashes, known deferrals, and release notes. Commit: `64d2f6f`; Verified: `git diff --check`; stale closeout text audit returned no matches for old baseline failure language across `README.md`, `docs/ROADMAP.md`, `AGENTS.md`, and this document. Updated README test/status notes, ROADMAP blocker/deferral section, AGENTS production-readiness status, and this Definition of Done to reflect passing local gates plus explicit Docker/shared-service environment deferrals.
 - [x] **P10.8** Push all commits and confirm remote branch status. Commit: `08112d2`; Verified: `git status --short --branch` reported `## main...origin/main`; `git rev-parse HEAD` and `git ls-remote origin refs/heads/main` both reported `07d32577539424b2be63c1a107d54e77d1f1699d` before the confirmation commit, then `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; git push'` pushed the P10.8 confirmation commit to `main`.