diff --git a/.kiro/specs/dirty-content-fingerprint/tasks.md b/.kiro/specs/dirty-content-fingerprint/tasks.md
index 3a9373c0..f8b1c76b 100644
--- a/.kiro/specs/dirty-content-fingerprint/tasks.md
+++ b/.kiro/specs/dirty-content-fingerprint/tasks.md
@@ -5,7 +5,7 @@
   - Observable confirmed live (independently re-verified by review, fresh scratch build): a bare `meson setup` with zero `-D` options configures cleanly (73 targets); all 542 C compile commands contain the new define (empty string), matching the existing two defines' counts exactly; no consumption code touched yet
   - _Requirements: 1.1, 5.1_
 
-- [ ] 2. Foundation: compute real fingerprint values at both build entry points
+- [x] 2. Foundation: compute real fingerprint values at both build entry points
 - [x] 2.1 (P) xce-build.sh computes the dev-loop fingerprint, independently of commit_id
   - `dirty_fingerprint` computed via `git diff HEAD` + `git ls-files -z --others --exclude-standard | LC_ALL=C sort -z` content, `sha256sum` truncated to 8 hex chars; empty on a clean tree or on computation failure (3 independently-verified graceful-degradation paths: mktemp failure, sha256sum failure, git diff failure -- none abort the script despite `set -euo pipefail`); zero working-tree/index mutation (read-only git invocations only); `commit_id`'s own computation left byte-for-byte untouched
   - Observable confirmed live (independently re-verified by review, real builds with HEAD pinned to control for concurrent background commits): editing a tracked file and rebuilding produces a fingerprint; different content produces a different fingerprint; reverting to the first edit's exact bytes reproduces the first fingerprint exactly; a `.gitignore`-matched `*.bak` file leaves the fingerprint unchanged; `commit_id`'s `-dirty` suffix stayed intact across every build; every profile (asan/debug/release) carries the option; the original feature's unmodified `test-build-version-regression.sh` passes twice in full (asan+debug)