docs(changelog): correct v1.8 entry — smoke count, CEG parity note, checklist

- smoke test count: 6→9 cases (adversarial rounds added 3 more)
- CEG bash floor: add known-divergence note (4 cases intentionally not
  ported per fleet parity decision — record-only until gate-path-bash >1%)
- distill-memory.py: downgrade from asserted to [UNVERIFIED]
- checklist: mark tag + release done (shipped as edf7b31/v1.8 tag)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: m9751

CHANGELOG.md

@@ -24,15 +24,15 @@ Six new hook ports, two new guides, one new smoke test, and updated `lib/normali
 
 - **`examples/hooks/claim-evidence-gate-dispatch.sh`** — Cross-platform dispatch wrapper for Gate 4. Probes the native Go binary with a two-probe trust check (must allow a clean payload AND block a claim-shaped payload) before trusting it. Falls back to `claim-evidence-gate.sh` if the binary is missing, wrong architecture, or fails either probe. Fail-closed with no runnable gate at all. Telemetry breadcrumb fires at the dispatch layer (single choke point). CEG fire_count>0 on Mac confirmed 2026-06-27 (PR #571).
 
-- **`examples/hooks/claim-evidence-gate.sh`** — Bash floor for Gate 4. Blocks assertion language patterns and explicit path-cited claims without a session Read breadcrumb. Pattern list aligned one-for-one with the Go binary's `assertionPatterns` (softened per ADR 0064 — bare "confirmed"/"verified" removed after 58/59 audit showed false positives). Empty stdin fails closed. Self-exempts via path-allowlist (the file itself is allowlisted to prevent gate self-block during deployment).
+- **`examples/hooks/claim-evidence-gate.sh`** — Bash floor for Gate 4. Blocks assertion language patterns and explicit path-cited claims without a session Read breadcrumb. Pattern list aligned one-for-one with the Go binary's `assertionPatterns` (softened per ADR 0064 — bare "confirmed"/"verified" removed after 58/59 audit showed false positives). **Known divergence from Go binary (intentional, record-only):** 4 cases differ — blockquote content, "describing past event", "described as", and narrative learning-log lines are allowed by the Go binary (narrative exclusion logic) but blocked by the bash floor. Decision: instrument first, port exclusions only if `gate-path-bash` rate exceeds ~1% over 7 days (fleet parity verified Mac + Win11, 2026-06-28). Empty stdin fails closed. Self-exempts via path-allowlist (the file itself is allowlisted to prevent gate self-block during deployment).
 
 - **`examples/hooks/aof-eval-opportunity-counter.sh`** — Fires on PreToolUse, SessionStart, and UserPromptSubmit (three settings.json registrations). POSTs to `eval.opportunities` table for DPMO measurement. **Health signal: `eval.opportunities` row count.** `telemetry.hook_events` fire_count is expected to be 0 for this hook (it does not use `bc_write` / `hook-telemetry-stop`). Port hardening: replaced hardcoded Supabase URL + anon key with `AOF_EVAL_SUPABASE_URL` + `AOF_EVAL_SUPABASE_KEY` env vars; hook fails open if either is unset.
 
 - **`guides/advanced/when-to-write-a-hook.md`** — Decision test for hook vs. rule. Three questions: (1) has the rule been violated with real consequence? (2) can the hook detect the violation mechanically? (3) is the blast radius acceptable? Includes hook type table by blast radius, what belongs in a rule (not a hook), hook anatomy invariants, and a 4-step test matrix before shipping.
 
 - **`guides/advanced/go-hook-dispatch-pattern.md`** — Canonical pattern for shipping Go binary hooks with a bash fallback. Explains the 2026-06-13 incident (Mach-O binary failing open on Win11), the two-probe trust model, build-at-install-time pattern, gitignore for architecture-specific binaries, bash floor alignment requirements, and settings.json registration via dispatch wrapper only.
 
-- **`tests/smoke/hooks/grok-shape-normalize.sh`** — 6-case smoke test for `lib/normalize-hook-input.sh`. Tests: camelCase normalization, snake_case passthrough, dual-shape conflict sentinel (`__NH_CONFLICT__`), empty input, malformed JSON. Gate: all 6 PASS before tagging v1.8.
+- **`tests/smoke/hooks/grok-shape-normalize.sh`** — 9-case smoke test for `lib/normalize-hook-input.sh` and gate enforcement. Tests: camelCase normalization, snake_case passthrough, dual-shape conflict sentinel (`__NH_CONFLICT__`), empty input, malformed JSON, gate-level Grok bypass block, gate control payload allow, conflict sentinel fail-closed. Gate: all 9 PASS before tagging v1.8.
 
 - **`examples/hooks/lib/normalize-hook-input.sh`** — Updated from v1.7 with dual-shape conflict detection. When a payload carries a field in both camelCase and snake_case shapes, `nh_normalize` now emits `__NH_CONFLICT__` sentinel instead of normalizing. The dispatch wrapper and gate check for this sentinel and fail closed (block) — a dual-shape payload is unevaluable; scanning one branch while the runtime executes the other risks claim bypass.
 
@@ -48,7 +48,7 @@ Six new hook ports, two new guides, one new smoke test, and updated `lib/normali
 
 - **Go binary for claim-evidence-gate** — the dispatch wrapper + bash floor ship; the public Go source does not. The private Go binary is architecture-specific (Mach-O arm64) and requires build tooling. Public port deferred until a portable build pipeline exists for the AOF repo.
 - **FORGET mechanism** — carried from v1.7. Still the hard prerequisite for Phase D global deploy of the memory system.
-- **`distill-memory.py` regex fix** — resolved in private config (2026-06-27); not a public AOF artifact. Removed from deferred list.
+- **`distill-memory.py` regex fix** — [UNVERIFIED — no Read of distill-memory.py was performed this session] reported as resolved in private config; not a public AOF artifact. Carry forward to v1.9 for confirmation.
 
 ### Release checklist
 
@@ -67,8 +67,8 @@ Six new hook ports, two new guides, one new smoke test, and updated `lib/normali
 - [x] Edit `README.md`
 - [x] Edit `examples/hooks/README.md`
 - [x] Insert CHANGELOG v1.8
-- [ ] `git tag v1.8 && git push --tags`
-- [ ] Create GitHub release
+- [x] `git tag v1.8 && git push --tags`
+- [x] Create GitHub release
 
 ---