diff --git a/PLAN-spring-clean-2026-08-06.md b/PLAN-spring-clean-2026-08-06.md
index 6129dcd..73fdc40 100644
--- a/PLAN-spring-clean-2026-08-06.md
+++ b/PLAN-spring-clean-2026-08-06.md
@@ -103,8 +103,7 @@ start from the live state.
   The backend alert API/worker remains because it is an active operational
   delivery path, not a projected page feature.
 - **Implementation:** added canonical grouping tests and updated owner
-  response/e2e coverage. Local implementation commit is recorded in the final
-  handoff after verification.
+  response/e2e coverage. Implementation commit: `1e5bc3b`.
 - **Quality gates:** backend `npx tsc --noEmit`; backend `npm test` = 273/273
   passing (271 existing tests plus 2 grouping tests); frontend
   `npx tsc --noEmit`, `npm test` = 76/76, `npm run lint:css`, and `npm run
@@ -126,4 +125,7 @@ start from the live state.
   live grouping payload because no owner MQTT credential is present on the
   host. Browser assertions found 2 identity cards, exactly 1 GNOME card, 1
   2E0MTU card, 3 and 2 member keys respectively, zero section tabs, and zero
-  settings UI. Screenshot: `SPRING-DASHBOARD-2026-08-06.png`.
+  settings UI. The temporary browser response uses the neutral label `owner`;
+  the screenshot contains zero `spring-dashboard-proof` text. A source and
+  shipped-app audit found no proof-mode toggle or proof token in the
+  frontend/backend bundle. Screenshot: `SPRING-DASHBOARD-2026-08-06.png`.
diff --git a/SPRING-DASHBOARD-2026-08-06.md b/SPRING-DASHBOARD-2026-08-06.md
index b82c631..83c732f 100644
--- a/SPRING-DASHBOARD-2026-08-06.md
+++ b/SPRING-DASHBOARD-2026-08-06.md
@@ -30,8 +30,11 @@ The Googlebot Playwright smoke loaded the real public owner route
 credential is available on this host, the smoke used the read-only live
 grouping payload from production and intercepted only the authenticated session
 and live requests; the deployed public JS/CSS and route were loaded from the
-real site. Assertions found 2 identity cards, 1 GNOME card, 1 2E0MTU card,
-member counts 3/2, zero section tabs, and zero settings UI.
+real site. The temporary session response uses the neutral label `owner`, not
+a proof label. Assertions found 2 identity cards, 1 GNOME card, 1 2E0MTU card,
+member counts 3/2, zero section tabs, zero settings UI, and zero
+`spring-dashboard-proof` text. No proof-mode toggle or proof token is present
+in source or in the shipped app image.
 
 Quality gates:
 
@@ -55,5 +58,5 @@ Deployed services use the spring-dash image tags and are healthy:
 
 Only `APP_IMAGE` and `WEBSITE_IMAGE` were updated in the ignored `.env`, as
 required. The backend image was supplied explicitly for this rollout without
-altering other `.env` lines. The implementation commit hash is added to this
-record immediately after the local code commit.
+altering other `.env` lines. The implementation commit is `1e5bc3b`; this
+screenshot/proof-audit update is recorded in the follow-up local commit.
diff --git a/SPRING-DASHBOARD-2026-08-06.png b/SPRING-DASHBOARD-2026-08-06.png
index e700443..404cc7f 100644
Binary files a/SPRING-DASHBOARD-2026-08-06.png and b/SPRING-DASHBOARD-2026-08-06.png differ