Verify Notarius credential lifecycle

docs/roadmap/implementation.md

@@ -178,7 +178,25 @@ Acceptance:
 
 ## Stage 3 — Verify command lifecycle, inspection, and resume invariants
 
-Status: Not started
+Status: Complete — 2026-09-16
+
+Completion: Extended command-boundary fixtures to cover Notarius credentials
+from conventional and explicit secret directories, environment precedence, and
+the existing-empty failure rule. Inspection coverage now proves validation,
+safe show/sources/diff output, ownership, profile replacement and null removal,
+and unavailable-reference rejection. Lifecycle tests verify manifests and the
+prepared effective pipeline omit credential bytes, while adding, removing,
+renaming, or rotating a valid loaded credential leaves extract's semantic
+fingerprint, resume eligibility, and downstream success unchanged without a
+second Notarius invocation. No fingerprint version, schema, or invalidation
+code changed.
+
+Checks:
+
+- `GOWORK=off go test ./internal/app ./internal/config ./internal/stage` — pass.
+- `GOWORK=off go test -race ./internal/app ./internal/config ./internal/stage` — pass.
+- `GOWORK=off go test ./...` — pass.
+- `git diff --check` — pass.
 
 Read: `internal/app/secrets_bootstrap.go`, `secrets_bootstrap_test.go`,
 `config_commands_test.go`, `config_loader.go`, `extract_lifecycle_test.go`,