docs: fix unchecked group-header checkboxes across 8 fully-implemented specs

controller-status, ha-commit-engine, ha-heartbeat-committed-propagation,
ha-prevote, ha-single-leader-role, ha-wal-replication, libxce-failover, and
raft-ha-core-safety each had every numbered sub-task marked [x] but their
group-header lines (e.g. "1. Foundation: ...") left unchecked -- a cosmetic
gap, confirmed by roadmap.md's own IMPLEMENTED/VERIFIED notes and zero real
unchecked sub-tasks in any of the eight files. No task content changed.

.kiro/specs/ha-commit-engine/tasks.md

@@ -3,7 +3,7 @@
 > TDD ordering per project steering (`testing.md`): every implementation sub-task is preceded by a testsuite sub-task that lands failing (RED) tests first. All new tests live in `testsuite/test_commit_engine.c` (brief-scoped single test file) plus targeted updates to `test_repl_majority.c` — this shared-file reality is why no `(P)` markers are applied: the test file and `repl.c` are touched by multiple groups, so the plan is sequential.
 > Verify exact line numbers with grep before editing (research.md table has the verified anchors; files drift).
 
-- [ ] 1. Commit engine core: per-LSN evaluation and commit-index integrity
+- [x] 1. Commit engine core: per-LSN evaluation and commit-index integrity
 - [x] 1.1 Write RED tests for per-LSN majority evaluation and commit-index integrity
   - Create `testsuite/test_commit_engine.c` against a stub `persist_t` + `replicator_t` (XCE_TESTING pattern, AAA structure) and register it in `controller_unit_test_src` (meson.build); create `src/controller/include/commit.h` with the umbrella-verbatim interface (types + prototypes only) so tests compile
   - Tests: with n_peers=3, a standby ACK for LSN M does not commit entry N>M (kills `acked_lsn > 0` counting); ACK watermark >= N from one standby plus self commits N; cumulative/out-of-order watermarks advance `committed_lsn` to the majority median, never past the highest appended LSN, never backwards; one far-lagging standby does not block majority commit; RETAIN mode returns 0 immediately without blocking
@@ -17,7 +17,7 @@
   - Observable completion: all task 1.1 tests PASS; engine is the only `committed_lsn` writer in `commit.c` paths
   - _Requirements: 1.2, 2.1, 2.2, 2.3, 5.1_
 
-- [ ] 2. WAIT mode, self-quorum, zero-peer rule, admission cap, own-term gate storage
+- [x] 2. WAIT mode, self-quorum, zero-peer rule, admission cap, own-term gate storage
 - [x] 2.1 Write RED tests for blocking-wait semantics and admission control
   - Tests in `test_commit_engine.c`: WAIT blocks until majority ACK then returns 0; WAIT returns `-ETIMEDOUT` at deadline with `committed_lsn` unmoved past the entry; n_peers=1 → WAIT returns 0 immediately and `committed_lsn` advances to the entry; n_peers=3 with zero standby ACKs → `-ETIMEDOUT`, never success (short-circuit regression); with n_vcpus=8 and reserved=2, a 7th concurrent WAIT gets `-XCE_ERR_NOT_READY` while the 6 admitted waits proceed; cap floor `max(1, n_vcpus - reserved)` holds for tiny n_vcpus; while the cap is saturated, `commit_on_ack` still advances `committed_lsn` and completes admitted waiters; `writable_lsn` unset (0) → no gating; `commit_set_writable_lsn(G)` with G > entry → waiter completes only once `committed_lsn >= G`
   - Observable completion: new cases FAIL (red) against the task-1 engine
@@ -29,7 +29,7 @@
   - Observable completion: all task 2.1 tests PASS; cap is expressed only relative to the `n_vcpus` init argument (no absolute constant other than the reserved headroom)
   - _Requirements: 1.1, 4.3, 4.4, 6.3, 7.1, 7.2, 7.3_
 
-- [ ] 3. Membership-change re-evaluation
+- [x] 3. Membership-change re-evaluation
 - [x] 3.1 Write RED tests for membership re-evaluation (completed jointly with 3.2 — RED unachievable, see Implementation Notes)
   - Tests in `test_commit_engine.c`: a catch-up standby's ACK watermark does not count toward a pending entry; after clearing `in_catch_up` and calling `commit_on_membership_change`, the pending waiter completes if the standby's watermark covers it; on standby removal that makes majority unreachable, a pending WAIT never returns success and fails with `-ETIMEDOUT` at its deadline; `commit_on_membership_change` returns without blocking
   - Observable completion: new cases FAIL (red)
@@ -40,7 +40,7 @@
   - Observable completion: all task 3.1 tests PASS
   - _Requirements: 4.1, 4.2_
 
-- [ ] 4. Quorum-accounting fix: catch-up exclusion at the dispatch gate
+- [x] 4. Quorum-accounting fix: catch-up exclusion at the dispatch gate
 - [x] 4.1 Write RED tests for write-admission quorum counting
   - Tests: `repl_active_standby_count` counts only slots with `ep != NULL && !in_catch_up`; `ha_has_write_quorum` with n_peers=3 returns false when the only connected standby is in catch-up, true with one active standby, false with zero connected; after simulated reconnect (registry restored) the gate accepts again with no reset call (stateless re-evaluation); n_peers=1 always true
   - Declare `repl_active_standby_count` in src/include/repl.h so tests compile
@@ -52,7 +52,7 @@
   - Observable completion: all task 4.1 tests PASS; existing dispatch-gate tests still green
   - _Requirements: 3.1, 3.2, 3.3, 6.1, 6.2_
 
-- [ ] 5. Integration: wire the engine behind the job-submit sync path
+- [x] 5. Integration: wire the engine behind the job-submit sync path
 - [x] 5.1 Write RED integration tests for the ACK feed and the sync-append path
   - Tests in `test_commit_engine.c`: `repl_on_ack` with a wired engine updates `acked_lsn` AND triggers commit evaluation (majority → `committed_lsn` advances, waiter wakes); `repl_start_catchup`/`repl_complete_catchup`/`repl_remove_standby`/`repl_add_standby` trigger re-evaluation; `persist_wal_sync_append` with wired engine returns 0 only on per-entry majority, returns `-ETIMEDOUT` when standbys' `acked_lsn` covers only an EARLIER entry (stale-ACK regression — connectivity/old ACKs never substitute), leaves `committed_lsn` unmoved on timeout, and for n_peers=1 returns 0 with `committed_lsn` advanced (replaces the old `-ENODEV` degraded path)
   - Update `testsuite/test_repl_majority.c` walAck cases to wire an engine and assert per-LSN semantics; configAck cases byte-identical
@@ -72,7 +72,7 @@
   - Observable completion: all task 5.1 tests PASS, including stale-ACK regression and single-node `committed_lsn` advancement; job submit on a wired cluster confirms only on per-entry majority
   - _Requirements: 1.1, 1.2, 1.3, 2.1, 4.4, 6.3_
 
-- [ ] 6. Validation: full regression and dishonest-path audit
+- [x] 6. Validation: full regression and dishonest-path audit
 - [x] 6.1 Run the full controller regression and audit the legacy paths
   - Build and run the complete controller testsuite with ASAN (`/xce-build controller`); fix any regression introduced by the short-circuit removal or the `committed_lsn` ownership move (existing persist/repl/ha suites)
   - Audit: grep confirms no production (engine-wired) walAck path reaches the `acked_lsn > 0` counting or the `n_active == 0 → success` branch; both survive only under the deprecated `ce == NULL` test fallback