docs(progress): G5 done; provision capstone fully scoped; frontier = provision + X9 + G4 (#72)

Author: gustavobertoi

PROGRESS.md

@@ -81,7 +81,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - [x] G2 macOS arm64 CI runner — **DONE** (PR #68: native `macos-14` lane — CGO-free build + `-race` unit suite + binary preflight; daemon steps stay on the ubuntu lane. Verified green on the PR.)
 - [x] G3 docs — **DONE**: QUICKSTART + TROUBLESHOOTING (PR #43) + THREAT-MODEL + MIGRATION (this PR). (Automated `import` field-mapping doc follows X9 / the devdock schema.)
 - [ ] G4 goreleaser tap + `.deb`/`.rpm` + Apache LICENSE + tag `v1.0` — partial (LICENSE done)
-- [ ] G5 two-terminal race tests — TODO  *(unblocked: C5 in; add to `tests/e2e` behind DEVSTACK_E2E)*
+- [x] G5 two-terminal race tests — **DONE** (PR #71: cross-process port-allocation race over the flock — subprocess-helper pattern, daemon-free, proves distinct ports across 5 processes = the lock-first invariant; surfaced + documented the concurrent-first-open/flock-FS hazard already covered by doctor's 9p probe).
 
 ## Human steps pending (owner)
 - Make the repo public when GA bits land: `gh repo edit open-source-cloud/devstack --visibility public --accept-visibility-change-consequences` (history is secret-clean).
@@ -122,3 +122,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
   - **G4 cut `v1.0`** — owner release decision (goreleaser/`.deb`/`.rpm`/LICENSE already in place).
   - **G5 two-terminal race e2e** — daemon-dependent + flaky-prone; the lock spine already has a unit concurrency test (`internal/lock`).
 - (night 3 cont.) **S4 + G2 + X3-postPull merged** (PRs #67/#68/#69) — resuming after the Stop-hook nudge that several "flagged" items had reasonable defaults. **M4 secrets COMPLETE** (S4 Infisical via the CLI with tolerant export-format parsing). **G2** added a native macOS arm64 CI lane (build + `-race` unit + preflight; verified green on the PR). **X3 postPull** wired into `ws sync` (HEAD-change-gated, no ledger needed). **69 PRs merged.** Genuinely-remaining: **provision saga phase** (M2 capstone — the one real user-facing-contract decision: publishing a shared-PG host port + auto-injecting per-project DB creds; recommended env-injected-placeholder design recorded above, wants a focused session + golden update + owner nod since it changes the no-host-ports default and may override an app's own DB config); **X3 firstRun** (blocked on provision's scope_key); **X9 import** (needs a real devdock `project.yaml` sample); **G4** (owner: cut `v1.0`); **G5** (two-terminal race e2e — daemon-dependent; lock spine already has a unit concurrency test).
+- (night 3 cont.) **G5 merged** (PR #71) — cross-process flock race test. **71 PRs merged.** With S4/G2/G3/G5/postPull all in this round, the autonomously-buildable frontier is exhausted; what's left is one large determinism-sensitive capstone + two externally-gated items:
+  - **provision saga phase** (M2 capstone; also unblocks X3 firstRun). Now fully scoped: (1) generate publishes shared-postgres `ports: ["${DEVSTACK_PG_PORT}:5432"]` — a *deterministic literal placeholder* so golden output stays byte-identical (golden needs a one-line update); (2) the saga allocates `DEVSTACK_PG_PORT` via `Manager.FreeHostPort` and injects it into the shared compose-up env; (3) a new `provisionPhase` (after shared-postgres healthy) pgx-connects to `127.0.0.1:<port>` as the template admin and runs `provision.Postgres.EnsureProject` per project that `uses: workspace.shared.postgres`, recording ownership in the `provisioned` ledger. **Two decisions make this a deliberate, not-rushed change:** the per-project DB **password lifecycle** (the `provisioned` table has no password column → either a *released, append-only* schema migration, or the dev-default `password = <project>` which needs no storage and suits a network-isolated dev DB) and the **cred-consumption contract** (recommended: app opts into the documented `postgres://<proj>:<proj>@shared-postgres:5432/<proj>` DSN — never auto-override an app's own DB env). It touches the determinism-golden path + adds host-side pgx, so it warrants a fresh focused session to land green, not a tail-end attempt.
+  - **X9 `import`** — needs a real legacy `devdock` `project.yaml` sample to map fields (can't invent the schema).
+  - **G4 cut `v1.0`** — owner release decision (goreleaser/`.deb`/`.rpm`/LICENSE all in place; tagging a public release is an outward-facing owner action).