docs(ci): record protected main rollout

tpot-analyzer/docs/EXPERIMENT_LOG.md

@@ -47,9 +47,14 @@ push would fail thousands of pre-existing lines, so the first-push case checks
 `HEAD^..HEAD`; pull requests use their exact base SHA and direct subsequent
 pushes use the event's prior SHA.
 
-**Next step:** Merge PR #8 only after the evidence-only follow-up run is green,
-then require the three observed contexts and pull requests on `main` while
-retaining administrator bypass during initial rollout.
+**Protection result:** PR #8 merged as `f5c12d2`; main run `32630037099` passed.
+Live protection requires pull requests and strict/up-to-date versions of the
+three app-bound GitHub Actions checks. Required approvals are `0`, administrator
+enforcement is off during initial rollout, and force pushes/deletions are off.
+
+**Next step:** Use the protected documentation PR that records this result as
+the first routine enforcement exercise; revisit administrator enforcement only
+after the workflow has a stable operating history.
 
 ---
 

tpot-analyzer/docs/ROADMAP.md

@@ -816,14 +816,14 @@ propagation out of TPOT to mainstream (no data on journalists/policymakers).
 
 ## Infrastructure & Tooling
 
-- [ ] **Make GitHub discover and enforce the CI workflow** — Actions is enabled, but
-  `gh workflow list` returned no workflows after the 2026-08-23 main push
-  because `test.yml` lives under `tpot-analyzer/.github/workflows/` instead of
-  repository-root `.github/workflows/`. The repair branch relocates it while
-  preserving project-directory detection and exact Python/Node 22 commands,
-  adds both production builds and patch hygiene. Push run `32629747636` and PR
-  run `32629769099` passed all three jobs; completion now requires merging PR #8
-  and requiring those observed checks and pull requests on `main`.
+- [x] **Make GitHub discover and enforce the CI workflow** — PR #8 relocated
+  `test.yml` to repository-root `.github/workflows/`, preserved Python 3.11 and
+  Node 22 test contracts, and added both production builds plus patch hygiene.
+  Push run `32629747636`, PR run `32629769099`, and merged-main run
+  `32630037099` passed all three jobs. `main` now requires PRs and strict,
+  GitHub-Actions-bound versions of those three checks; administrator bypass is
+  retained initially and force pushes/deletions are disabled (completed
+  2026-08-23).
 - [ ] **Retire the 2026-08-23 consolidation recovery assets deliberately** —
   choose a retention window, then use `verify_repository_consolidation.py`
   before removing any dated preservation ref, worktree, parked stash, bundle,

tpot-analyzer/docs/WORKLOG.md

@@ -39,10 +39,14 @@
       respectively. This confirms discovery, both event triggers, the exact
       check names, and successful clean hosted installs/builds—not merely local
       equivalence.
-    - **Remaining gate:** merge PR #8 after its evidence-only follow-up run,
-      then require those three observed checks plus pull requests on `main`.
-      Administrator bypass remains enabled initially so an incorrect new rule
-      cannot lock maintainers out.
+    - **Completion:** PR #8 merged as `f5c12d2`; its `main` push run
+      `32630037099` also passed all three jobs. Live branch protection now
+      requires pull requests and strict/up-to-date, GitHub-Actions-bound
+      `Python (pytest)`, `public-site (vitest + build)`, and `graph-explorer
+      (vitest + build)` checks. Required approvals remain `0` for the solo
+      repository, administrator enforcement is initially off, and force pushes
+      plus branch deletion are disabled. This evidence-only record is being
+      delivered through a second PR so the installed rule governs it.
 
 ## Repository Preservation and Canonical-Main Consolidation (2026-08-23)