docs: amend Docker evidence portability contract

Author: TrentBrown

docs/issues/tb-portreeve-stacks/issues.md

@@ -141,7 +141,7 @@ human review and merge.
 
 ## I-6 - Add the desktop Stacks experience and failure details
 
-- **Status:** in-review
+- **Status:** closed
 - **Estimate:** 3d
 - **Plan steps:** P7
 - **Rubric criteria:** R8
@@ -171,11 +171,18 @@ desktop, protocol, client, CLI, package, and boundary gates passed.
 - **Plan steps:** P8
 - **Rubric criteria:** R1, R2, R3, R4, R5, R6, R7, R8
 - **Depends on:** I-3, I-5, I-6
-- **PR:** -
+- **PR:** [#13](https://github.com/TrentBrown/portreeve/pull/13)
 
 Finish public documentation and representative examples, run mixed-stack and legacy
 end-to-end matrices on supported native environments and the packaged desktop, execute
 every workflow gate, and preserve the feature-final evidence and completion report.
 
 **Started 2026-08-07.** Final sequential delivery branch
 `tb-portreeve-stacks-07-feature-final` begins from merged `main` at `0fc3865`.
+
+**Implementation complete 2026-08-07.** PR #13 adds public desktop and representative
+mixed-stack launcher guides plus a disposable assembled process/Docker lifecycle gate.
+The first Linux run exposed that Docker Engine kernel-NAT publication has no userspace
+listener; binding-appropriate Docker inspection replaced that false portability
+assumption. The corrected matrix passes on Linux x64/ARM64 and macOS x64/ARM64, and the
+packaged macOS ARM64 desktop launches with healthy service and Stacks evidence.

docs/issues/tb-portreeve-stacks/spec.md

@@ -74,3 +74,14 @@ The global Definition of Done in the software development workflow applies.
 ## Changes
 
 Append spec amendments here. Do not remove or weaken original criteria.
+
+### 2026-08-07 - AC3 Docker publication evidence portability
+
+The AC3 phrase "fresh listener evidence" remains literal for process-backed endpoints.
+For Docker-backed endpoints, fresh publication evidence is binding-appropriate: exact
+fresh Docker inspection must prove the submitted container is running, carries every
+activation label, and publishes the allocated loopback host port to the declared
+container port. A userspace listener observed by `lsof` is corroborating evidence, but
+its absence is not a failure because supported Linux Docker Engine configurations may
+publish through kernel NAT. A stored container ID alone remains insufficient, Docker
+never uses process lineage, and Portreeve still makes no application-health claim.