docs: fix unchecked group-header checkboxes across 8 fully-implemented specs

controller-status, ha-commit-engine, ha-heartbeat-committed-propagation,
ha-prevote, ha-single-leader-role, ha-wal-replication, libxce-failover, and
raft-ha-core-safety each had every numbered sub-task marked [x] but their
group-header lines (e.g. "1. Foundation: ...") left unchecked -- a cosmetic
gap, confirmed by roadmap.md's own IMPLEMENTED/VERIFIED notes and zero real
unchecked sub-tasks in any of the eight files. No task content changed.

.kiro/specs/controller-status/tasks.md

@@ -3,14 +3,14 @@
 > TDD is mandatory (project rule): add the failing C test in `testsuite/` (or a piped `xce_test` behavioral script) before the change — red → green → refactor.
 > The work runs along a single request path (schema → controller handler → dispatch gate → libxce client → test command → wait-primary), so tasks are sequential by design; no `(P)` markers. The one HA-critical change is the dispatch-gate allow-list (task 2.2).
 
-- [ ] 1. Foundation: status reply schema + codegen
+- [x] 1. Foundation: status reply schema + codegen
 - [x] 1.1 Add the `ctrlstatus` opcode and the status reply payload to the schema
   - Add a new request opcode `ctrlstatus` (next free ordinal) and a new reply-union member (next free ordinal), plus a lean status payload struct carrying: cluster name, primary name, responder name and role, term, loaded config version and content checksum, committed config version, commit and apply positions, fenced flag, and a bounded list of configured controllers (name, host, port) with a count.
   - Keep the payload focused on identity/health only — it must NOT carry the resource/queue/worker inventory.
   - Observable: the build regenerates the C types for the new payload and opcode (the generated status type, its reply-union tag, and a free helper exist) and the schema compiles clean.
   - _Requirements: 1.1, 1.4, 2.1, 3.1, 3.2, 4.1, 4.2, 5.1, 5.2, 6.1, 6.2, 6.3, 6.4_
 
-- [ ] 2. Controller: status handler + any-role dispatch
+- [x] 2. Controller: status handler + any-role dispatch
 - [x] 2.1 Implement the controller status handler
   - Add a handler that snapshots the responding node's local HA and config state into the status reply: responder name and role; current primary (taken under the HA lock; empty when none is known/elected); term; loaded config version + content checksum; committed config version; commit and apply positions; fenced state (catch-up or unrecoverable-fence); and the configured controllers list with count. It must be read-only (no state mutation) and answer in every role.
   - Route the new opcode to this handler in the controller request dispatch switch.
@@ -26,7 +26,7 @@
   - _Boundary: ha_dispatch_gate_
   - _Depends: 2.1_
 
-- [ ] 3. libxce client API
+- [x] 3. libxce client API
 - [x] 3.1 Add the failover-aware any-node status call
   - Add the opcode-only request sender, the send-and-decode call, and the failover-aware client read (retryable, non-write) that returns whatever reachable node answers, plus the free helper. On no reachable controller, return a typed failure without a partial/empty success.
   - TDD: a round-trip test decodes every status field from a handler reply; a no-reachable-controller test returns a typed failure.
@@ -42,7 +42,7 @@
   - _Boundary: libxce client_
   - _Depends: 3.1_
 
-- [ ] 4. Test client command + wait-primary integration
+- [x] 4. Test client command + wait-primary integration
 - [x] 4.1 Add the `ctrlstatus` client command
   - Add a client command that issues the any-node status call and prints the fields in human-readable form: the current primary, the answering node framed as "answered by <node> (<role>)" distinct from the primary, the configured controllers and count, the loaded config version and committed config version, the content checksum as hex, term, commit/apply positions, fenced state, and cluster name; render an empty primary as "unknown". The command exit status reflects success or failure of the query.
   - Observable: piping `ctrlstatus` through the client prints the status fields (with "answered by" and "unknown" rendering) and exits zero on success / non-zero with the error printed on failure.
@@ -56,14 +56,14 @@
   - _Boundary: cmd_wait_primary_
   - _Depends: 3.2_
 
-- [ ] 5. Validation (live cluster)
+- [x] 5. Validation (live cluster)
 - [x] 5.1 End-to-end status + authoritative wait-primary on a live cluster
   - Run against a live 3-node cluster: `ctrlstatus` on a healthy cluster shows the correct primary, peers, and version+checksum; querying via a standby still reports the primary with the "answered by <standby>" framing; the version+checksum match across nodes with identical config; and the authoritative wait-primary returns immediately on a healthy cluster, blocks until the NEW primary itself answers after a primary kill (without false-succeeding on a standby's stale primary view), and times out when no primary serves.
   - Observable: the live run shows a correct status (primary/peers/checksum) including via a standby, and the authoritative wait-primary names the new primary after a kill without a false success; manual environment prerequisite (live cluster), same status as other live-E2E tasks.
   - _Requirements: 2.3, 5.3, 7.1, 7.2, 8.1, 9.1, 9.2, 9.3, 9.4_
   - _Depends: 4.1, 4.2_
 
-- [ ] 6. Delta: off-primary committed fidelity + responder timestamp (Req 10, 11)
+- [x] 6. Delta: off-primary committed fidelity + responder timestamp (Req 10, 11)
   > Sequential, single request path (schema → typemap → `ctrlstatus_fill` → render → E2E); no `(P)`. Read-only reporting only — the live-fresh-committed heartbeat change is OUT of boundary (route to ha-heartbeat-liveness / ha-repl-hardening).
 - [x] 6.1 Add the responder snapshot timestamp field to the schema + hand-authored typemap
   - Append a responder snapshot-time field to the status payload at the next free ordinal (after the peer count), carrying the responder's wall-clock at sample time as epoch milliseconds (append-only — never reorder existing field ordinals). Add the matching field to the hand-authored `xce_ctrlstatus_t` typedef in `src/include/typemap.h` and verify it field-for-field against the regenerated codec (per the 1.1/2.1 learning: `$C.mapname` types are NOT auto-generated here).