feat: automate classification convergence

workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md

@@ -124,7 +124,7 @@ Process/database health, repository reads, and zero-restarter startup all pass.
 
 ```task
 id: CUST-WP-0064-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "6c645778-be59-57b1-bf44-d974a3a1e49f"
 ```
@@ -143,8 +143,16 @@ It then projected the live oldest-three target set (`can-you-assist`,
 The existing unpaused Temporal schedule was reconciled unchanged at limit 3
 and operator-triggered: it froze exactly those targets, spawned zero tasks,
 created three provenance-bearing terminal `no-manifest` snapshots, and moved
-`never_count` 94 to 91. Keep this task open for sustainable projection as each
-new oldest-N batch is exposed.
+`never_count` 94 to 91.
+
+**Done (2026-08-23):** after that controlled batch advanced, the next oldest
+three (`citation-work`, `clay-borg`, and `config-atlas`) were selected with
+matching `forgejo-archive-v1` references and full 40-character revisions. An
+in-worker read-only report probe on deployed Activity Core digest
+`sha256:9c611a394c117c8ccfe2fd813c0dda1943ea8a7444aa4bd4742d83712b2cf559`
+returned `selected_count=3` and `controlled_source_count=3`. This proves
+source-reference projection follows each newly exposed bounded batch rather
+than the attended target set; T04 retains only the first unassisted fire.
 
 ## Prove real daily freshness improvement