fix(portal): prepare approved resource mappings safely

www/reports/SESSION_HANDOFF.md

@@ -21,6 +21,24 @@ private manifests and resources must never enter Git, `dist`, source snapshots,
 logs or deployment manifests. `/employee-portal` remains noindex and excluded
 from sitemap/hreflang. Form A, referral and publication behavior are unchanged.
 
+### Portal resource preparation correction — 2026-11-04
+
+The resource schema now separates approved source-to-role mapping from actual
+VPS installation evidence. An approved mapping may be prepared and installed
+while all server-installed/hash/permission/authentication/URL verification flags
+remain false. Shared resources can be installed from one verified source into
+both protected namespaces without weakening management isolation. The owner-only
+private workflow identifies the two encrypted streams via hidden prompts,
+derives deterministic role mappings, rewrites all legacy employee `/hubfs/`
+links, and creates a hash-bound private readiness record. A real production
+ciphertext cannot pass `npm run deploy -- --dry-run` merely because it is
+structurally valid.
+
+The first resource install no longer depends on a previously promoted site
+release: the reviewed POSIX installer is staged from the exact Git commit and
+verified by SHA-256 before root execution. Server installation, SOPS-backed
+Basic Auth and protected URL verification remain future VPS-rehearsal gates.
+
 ## Current referral decision — 2026-11-01 (supersedes Form C planning)
 
 The owner directs `/referrals` to retain the current public-site workflow: one