diff --git a/docs/codex-for-oss-application.md b/docs/codex-for-oss-application.md
index 82c6d21..75710a0 100644
--- a/docs/codex-for-oss-application.md
+++ b/docs/codex-for-oss-application.md
@@ -105,7 +105,7 @@ Refresh this section on 2026-07-24 immediately before submission. Current candid
 
 - public repository with MIT license;
 - `v0.9.0` release candidate, with v0.8.0 already public;
-- 36 local adversarial tests; remote Node.js 20, 22, and 24 CI remains a release gate;
+- 36 adversarial tests passing locally and in remote Node.js 20, 22, and 24 CI;
 - dependency-free CLI, GitHub Action, and installable Codex plugin;
 - 3 prior maintainer PRs merged with green CI; add the v0.9 PR after merge;
 - 2 stars, 0 forks, and no verified external contributor yet;
diff --git a/docs/launch.md b/docs/launch.md
index 7796771..35eefd2 100644
--- a/docs/launch.md
+++ b/docs/launch.md
@@ -8,7 +8,7 @@ Target: Friday, 2026-07-24
 - [x] Safe and unsafe refund fixtures are reproducible.
 - [x] Local `npm run verify` and `npm audit --omit=dev` pass.
 - [x] QA, adversarial Red Team, and Guardião reviews are documented.
-- [ ] Pull request CI passes on Node.js 20, 22, and 24.
+- [x] Pull request CI passes on Node.js 20, 22, and 24.
 - [ ] Release commit is merged and tagged `v0.9.0`.
 - [ ] Released CLI and pinned Codex marketplace install successfully.
 - [ ] GitHub release is published on Friday.
diff --git a/docs/release-audit.md b/docs/release-audit.md
index 169b389..aa4a4c7 100644
--- a/docs/release-audit.md
+++ b/docs/release-audit.md
@@ -4,7 +4,7 @@ Target release: 2026-07-24
 
 ## Decision
 
-**APTO COM RESSALVAS** for the Friday release, pending the remote CI and released-install checks listed below.
+**APTO COM RESSALVAS** for the Friday release, pending merge, tag, and released-install checks listed below.
 
 No blocking defect remains in the reviewed static-analysis boundary. Vibeflow can verify structural evidence in an exported workflow, but it cannot enforce authorization, amount limits, counterparty identity, audit durability, or recovery behavior in the executing systems.
 
@@ -56,15 +56,15 @@ The graph checks use actual `main` edges, require dominating controls, and rejec
 - an exported graph cannot prove a referenced credential, approval identity, SQL policy, external API limit, notification, or compensation works at runtime;
 - custom/community nodes may need explicit impact declarations or new regression-backed adapters;
 - repository owners may intentionally weaken policy outside `--locked` mode;
-- remote Node 20/22/24 CI and released `npx`/plugin installation can only be confirmed after the candidate is pushed and tagged.
+- remote Node 20/22/24 CI passed; released `npx`/plugin installation can only be confirmed after the candidate is tagged.
 
 ## Release blockers
 
-- [ ] Pull request CI passes on Node.js 20, 22, and 24.
+- [x] Pull request CI passes on Node.js 20, 22, and 24.
 - [ ] Release commit is merged without unrelated changes.
 - [ ] `v0.9.0` tag and GitHub release are published on 2026-07-24.
 - [ ] Released CLI and Codex plugin install paths are smoke-tested.
 
 ## Final gate
 
-There are zero known critical or high security findings in the local candidate. The release remains **APTO COM RESSALVAS** until the four remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.
+There are zero known critical or high security findings in the candidate. The release remains **APTO COM RESSALVAS** until the remaining remote gates above are complete; a failed gate blocks publication or requires an immediate corrective release.