docs(canvas): record migration coordinator service evidence and handoff boundary

headless/SERVICE_ACCEPTANCE.md

@@ -6,15 +6,16 @@ the complete Draft acceptance matrix, main integration or production deployment.
 
 ## Verified revisions and environment
 
-- Endoleap consumer: `580a14f508bc695bfed99d60c42f0d4df36b15b2`.
-- Foundry: `d00388504cda5ce267b61cc5deb919c71a9d5e25`.
-- [Foundry CI #1178](https://gitea.entroia.com/Zayden-Jung/foundry-core/actions/runs/1178):
-  completed successfully; job 1275, all seven steps successful. The previous
-  client/service baseline also passed CI #1174 and #1175.
+- Endoleap consumer: `26da326c18bdf5363c646dff87756590b29433ea`.
+- Foundry: `3268c57bc64cb85f9de80d5e04107d963ede963a`.
+- [Foundry CI #1180](https://gitea.entroia.com/Zayden-Jung/foundry-core/actions/runs/1180)
+  and [PR CI #1181](https://gitea.entroia.com/Zayden-Jung/foundry-core/actions/runs/1181):
+  completed successfully; jobs 1277/1278, all seven steps successful. The original
+  service scope audit also passed CI #1178 and #1179.
 - Existing `ces-control` runner executes Go checks/build, schema migration and
   isolated PostgreSQL integration, then the pinned Node 24 consumer and HTTP smoke
   checks. No local backend build or Docker execution was used.
-- Local frontend: 785 Node tests and full TypeScript checking passed. Tests use
+- Local frontend: 797 Node tests and full TypeScript checking passed. Tests use
   the source modules; packaged SDK and application delivery remain separate gates.
 
 ## What the checks actually prove
@@ -29,6 +30,7 @@ the complete Draft acceptance matrix, main integration or production deployment.
 | Resources and authorization | The consumer verifies lost upload ACK, shared pending-image upload, original bytes, metadata, cross-project adoption and reopen. `TestOnboardingAndSharing` additionally revokes source access after warm reads, verifies no target model/version/binding changes, preserves the rejected receipt after permission restoration, and checks independent target access. |
 | AI execution identity and controls | `TestCanonicalAIAdmissionAndLifecycle` covers admission/query/retry, zero-effect rejection, old incarnation callbacks, cancellation, managed image output, owner relocation, archived admission routes and execution after permission revocation. |
 | Actual frontend RunPort | `tests/headless/foundry-ai.integration.mjs` exercises `createFoundryRuns`, the HTTP transport and ProjectEngine: successful admission response loss/reopen/query, queued cancellation response loss, generation-time content conflict, explicit apply response loss plus undo/reopen/redo, generated image metadata/original bytes/preview, and copy without a new run or upload. |
+| Host identity migration coordination | `canvas-migration.ts` now drives the real consumer's initial migration: the server commits, the response is lost, a new coordinator reads the stored body/key and queries the original receipt without a second POST. A later intentional raw POST still checks backend idempotent retry. The coordinator's drain and lock ports are fixtures here; this does not prove the old editor's browser handoff gate is connected. |
 
 The CI #1174 consumer report contains `status: "ok"`, 72 HTTP transport calls,
 all 14 prior document/resource flags true, plus `runtimeAI`, `aiLostAdmission`,
@@ -40,6 +42,11 @@ CI #1178 repeated the same pinned consumer successfully with 71 transport calls
 and the same flags/execution count. Timing-dependent poll counts are observations,
 not an exact total-call contract; admission/action/upload duplication has separate
 explicit assertions.
+CI #1180 additionally reports `migrationCoordinator` and
+`migrationLostAckRecovered` true, with 76 transport calls and the same document,
+resource and AI results. The local coordinator suite covers 11 cases, including
+quota/no-write behavior, uncommitted-request recovery, invalid receipt retention,
+identity/abort fences and terminal rejection followed by explicit preparation.
 
 ## Issues exposed by the real consumer
 
@@ -65,6 +72,10 @@ The recovery store is an in-memory durable-batch fixture, and response loss is
 injected after successful HTTP responses. Real IndexedDB/Web Locks/browser
 acceptance is recorded separately in `STEP4_ACCEPTANCE.md`; this service run does
 not combine every browser crash window with every server operation.
+The migration coordinator uses an injected string-storage port before a canonical
+engine exists. The browser still needs its legacy editing freeze/drain, actual
+storage and workspace lock wiring, reload handling and upgrade UI. Stage 6 is not
+complete merely because the coordinator's ports pass unit and service tests.
 
 `canvas_headless_worker_integration_test.go` supplies deterministic generation
 output over the actual worker HTTP protocol. Admission, claim, events, canonical