SECURITY-169-API-36: close train state

[fermatmind]

What changed

• Marked SECURITY-169-API-36 merged in the PR-train state ledger.
• Recorded implementation commit, PR merge evidence, and local/remote cleanup completion.

Why

The implementation PR is merged and post-merge revalidation is complete; the train ledger must reflect the durable state before API37 starts.

Validation

• python3 -m json.tool docs/codex/pr-train-state.json
• single-file ledger scope validation
• git diff --check

Deferred items

• Runtime route, migration, curl, and MBTI commands are not applicable to this docs-only closeout.
• No staging wait, CMS/search write, production import, manual deploy, or production deploy was executed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f4e84e2549

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Record the merge SHA when marking API-36 merged

When this entry is moved to merged, the same object still has commit_sha: null even though the new event records squash merge 9fe89687b8194e2208316197cf206a7603fec4ec. The ledger rules require merged train closeout to record commit_sha; leaving it null makes later audit/dependency evidence incomplete despite the item being closed.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove the unrelated Enneagram SHA mutation

This SECURITY-169-API-36 closeout also stamps ENNEAGRAM-EN13-PUBLISH-CACHE-WARM-01 with a concrete commit_sha while that production-write item remains pending_exact_production_authorization with no PR URL, checks, or transitions explaining the change. That makes the pending gate ambiguous and corrupts the audit trail for an unrelated train item; leave it null unless the Enneagram item is advanced with proper evidence.

Useful? React with 👍 / 👎.