Conformance updates.

docs/PROCESS.md

@@ -356,6 +356,28 @@ needs a directory to exist, create it in the same group.
 
 ---
 
+## 9a. The baseline check
+
+`ct-baseline.sh` is the executable definition of the container standard on this
+host. Read-only, runnable at any time, exits non-zero on divergence.
+
+Run it:
+
+- before starting work on a container;
+- after any change to a container or to host firewall rules;
+- after any host reboot;
+- before considering backup work (see `ENVIRONMENT.md` §15 gate 4).
+
+**A property not checked by it is not part of the standard.** If something
+should be uniform across containers, add it to the script. If it should not,
+leave it out and stop worrying about the difference. That is the whole point:
+it converts an endless comparison into a pass or a fail.
+
+It covers containers belonging to more than one project, and encodes host
+requirements neither project owns alone. Treat it as host property.
+
+---
+
 ## 10. Current mode
 
 **Infrastructure: complete and accepted.** Host, containers, network isolation,
@@ -366,6 +388,12 @@ bastion access, TLS, reverse proxy, mail alerting, disk monitoring. See
 more than an afternoon; the documents are in Gitea. This changes when
 `artifacts/` stops being empty.
 
+**Repository seeded** at `c7e32d8`: reference implementation, frozen oracle,
+pinned toolchain, test harness. Dependencies installed in CT 100, oracle
+verified in-container, `3 passed, 236 skipped`.
+
+**Container baseline established.** All three containers on `srv-b` conform.
+
 **Development: starting.** First work item is the Shapely port —
 `pytest -n auto` green against the 123 frozen cases.