Record R17 package validation and pending onboard transfer

docs/audits/2026-09-07-node-home-and-local-k1-r17.md

@@ -65,7 +65,7 @@ compiled shared environment model as well as ui-react and styles.
   passed (34 components, 48 icons). Three shared media/model/DOM tests passed.
 - Core architecture: 4 tests; complete frontend: 809/809; TypeScript and production
   build passed. Existing operator-environment v3 API/storage is unchanged.
-- Node TypeScript and UI boundary check passed; all Go packages passed. Six new
+- Node TypeScript and UI boundary check passed; all Go packages passed. Five new
   Go test functions cover persistent trimmed home copy, simultaneous revision
   conflict, rejection without overwriting, corrupt-state preservation, validated
   PNG upload/hash/reopen/HTTP Range, session/Origin restrictions and scoped CSP.
@@ -92,3 +92,25 @@ limited to 256 MiB/file and 8 GiB total. External images/video are browser-loade
 HTTP(S) URLs. Media cleanup beyond rejected-upload temporary files is not added;
 recordings, identity, pairing and the installed credential are not part of this
 store. No marketing-image fallback is supplied.
+
+## Candidate and handoff
+
+Source: a23c5b2005f7e27382ea21131f5a42a61cfec82e.
+Canonical Node builder completed after the source commit. The UI production
+build passed. `mission-core-node_0.8.14_amd64.deb` is 109863396 bytes;
+SHA-256 `9bf4188cd51628144a9126ccfd33afce1503870c13548e31336b9484dce052aa`.
+Archive inspection verified 71 regular files, source/DG provenance, no secret or
+runtime-state payload. Local release: `private/releases/mission-core-node-20260907-r17`.
+The reviewed Ubuntu installer uses the existing preinst safety guards and
+preserves installed K1 0.1.13 and private state. No Synology deploy is involved.
+
+Read-only Ubuntu check confirmed installed Node 0.8.13 and K1 0.1.13, both active.
+The immutable candidate directory was created, but automatic approval review
+rejected scp before execution: destination ownership for private code egress
+requires explicit owner confirmation. The owner was asked to confirm the
+Ubuntu address. No candidate transfer/installation is claimed. Do not retry
+transfer until that confirmation is supplied.
+
+Ops MISSIONCOR-76 baseline and state are preserved. Comment
+`d16d36ed-f746-4fb9-8a63-f8d1a72f7e2d` records implementation, tests, candidate,
+remaining UI/physical acceptance and transfer block; readback confirmed it.