Docs/close-out: true the ROADMAP to the 000159 outcome, with PR #108 still HELD (000160 leg 3)

[manderse21]

Dispatch 000160 leg 3, plugin-repo half. Zero code, no version bump, docs only.

Why this reads "held" everywhere

Leg 1 derived the forge state with gh rather than inferring it: PR #108 is OPEN (mergedAt null, mergeCommit null), releases/latest is still v1.27.1, and origin/main is 4690cdb -- PR #107's merge commit, so main has not moved since 000159 branched. That is state (c) of the three the charter pre-adjudicated, so every 000159 claim here is labelled staged-on-held-PR, never shipped.

What changed

• Header -- re-derived at write time, not copied. git describe --tags origin/main = v1.27.1-10-g4690cdb; both manifests parse 1.27.1 in lockstep. A new paragraph records v1.27.2 as PREPARED but NOT MERGED and NOT RELEASED, with three independent reads agreeing.
• Section 2 -- a 000159 record: legs 1a/1b/2 staged on HELD: 000159 legs 1-2 -- flake instrumentation, 5.1 SARIF validation, ManifestConsistency multi-name export fix (prep v1.27.2) #108, leg 3 the recorded NO-BUILD at 7.14% minimum measured FP (2 of 28) on a re-enumerated 325-file oracle against a 0% bar, the structural cause (GetCommandName() is $null for & $expr), and the adopted-commits provenance re-run per Hub Rule 7.
• Section 6 -- flake item gains the instrumentation status (steps 1-2 built, step 3 still the named next move); the 5.1 SARIF item becomes fixed-and-HELD; and a new item for the ManifestConsistency class that is 99.89% false-positive on real modules and currently unchartered.
• S3.4 -- leg 3's no-build recorded as the measure-first bar's first refusal.

On the 281 -> 325 oracle numbers

Deliberately not treated as a correction. The installed-module set is machine state, so 281 and 325 are two different machine-days; the rows citing a 281-file oracle for 000139 stand unedited, and the roadmap says why.

Verification

The recorded checks pin the ROADMAP by blob SHA rather than by branch or worktree path, so they resolve the same bytes before and after this merges. RED-proven by swapping in the pre-edit blob: exit 1 at "header does not carry the live describe string". 19 000159 hits, count asserted greater than zero.

Nothing was deleted and no workflow was triggered. Per Hub Rule 8, verified is post-merge and is yours.

Hub-side PR (DEV_NOTES ledger + session ledger + outbox) is separate.