diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e264de..6eabc26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- Classify raw HTTP response bytes through one shared parser before decoding.
+  Classic OQL exposes deterministic binary evidence as `_body`, while Unified
+  IR exposes the same `kind`, normalized MIME, byte length, SHA-256 and magic
+  fields as `body`; JSON and bounded text remain compatible.
 - Align production and E2E Docker builds with the `testql/` package layout,
   install extracted test plugins in the E2E image and remove obsolete `src/`
   mounts from all Compose configurations.
diff --git a/README.md b/README.md
index 0fe5b39..23b761b 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,11 @@ Generated on 2026-07-21 using [openrouter/qwen/qwen3-coder-next](https://openrou
 
 TestQL is a declarative DSL (Domain Specific Language) for testing GUI, REST API, and hardware encoder interfaces. It provides a simple, readable syntax for writing automated tests without programming overhead.
 
+> **Version state (2026-09-01):** PyPI and `testql.__version__` still report
+> 1.2.66. The repository `VERSION` and builds from `main` report 1.2.67.
+> Binary HTTP response evidence is merged in source commit `6b80259dadae` but
+> is not yet present in the PyPI package.
+
 ### What's new in 1.2.x
 
 - **Native Desktop E2E**: `DESKTOP_*` commands with vdisplay mirror→Xvfb capture, img2nl + imgl OCR on Linux (no Wayland portal)
@@ -370,6 +375,37 @@ ASSERT_JSON status != "error"
 
 **Operators:** `==`, `!=`, `>`, `>=`, `<`, `<=`, `CONTAINS`
 
+#### Binary HTTP response evidence
+
+Source builds from merge `6b80259dadaee4738bf97d77ecd90b6f9a64f8f6`
+classify the raw response bytes before attempting text decoding. Existing JSON
+objects/lists and bounded text keep their compatibility payloads. PNG, PDF,
+JPEG, GIF, ZIP and gzip responses expose evidence without inserting replacement
+text into the response:
+
+```testql
+API GET "/render.png"
+ASSERT_STATUS 200
+ASSERT_JSON _body.kind == binary
+ASSERT_JSON _body.content_type == image/png
+ASSERT_JSON _body.magic == png
+ASSERT_JSON _body.byte_length > 1000
+```
+
+`_body` always contains `kind`, normalized `content_type`, `byte_length`,
+`sha256` and detected `magic`. The Unified IR executor exposes the same fields
+under `body`, so the classic interpreter and IR runner cannot disagree about a
+binary response. Magic bytes take precedence over a misleading text MIME type;
+SVG remains bounded text with `magic=svg`.
+
+Until a release newer than 1.2.66 reaches PyPI, install the immutable merged
+source when these assertions are required:
+
+```bash
+python3 -m pip install \
+  "git+https://github.com/autogrammar/testql.git@6b80259dadaee4738bf97d77ecd90b6f9a64f8f6"
+```
+
 #### Shell output assertions
 
 `ASSERT_JSON` reads the last API response. To assert on a JSON report printed by
diff --git a/TODO.md b/TODO.md
index 4c1c182..d74ac28 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,6 @@
 # TODO — TestQL Development Roadmap
 
-Last updated: 2026-05-08 (1.2.50 — multi-scenario watchdog + docs update)
+Last updated: 2026-09-01 (1.2.67 source — Docker and binary HTTP evidence)
 
 ## 🎯 Active Development Priorities
 
@@ -52,6 +52,8 @@ Last updated: 2026-05-08 (1.2.50 — multi-scenario watchdog + docs update)
 
 - [x] Repair Docker build inputs after the package moved from `src/` to
   `testql/`, and make the E2E image install the extracted local plugins.
+- [x] Preserve deterministic MIME, byte length, SHA-256 and magic evidence for
+  binary HTTP responses in both the classic and Unified IR executors.
 
 > **Note:** Complete prefact-generated issues (848 items) archived to `.archive/TODO_prefact_2026-04-25.md`
 
diff --git a/project/ticket-001/README.md b/project/ticket-001/README.md
index 2f8f141..51947fb 100644
--- a/project/ticket-001/README.md
+++ b/project/ticket-001/README.md
@@ -42,6 +42,15 @@ dependency graph pulls Playwright, LiteLLM, pandas, boto3 and notebook tooling.
 Dependency separation belongs to the integration workstream and is deliberately
 not mixed into this packaging repair.
 
+## Publication evidence
+
+Validator approved exact HEAD `d7ff12cb98cd86510320f1e9d8e41f3161c423d4`
+and merged [PR #7](https://github.com/autogrammar/testql/pull/7) as
+`1125743e4854eed84c3ee7c6b0a5d17c572fd16f`. Required post-merge CI passed and
+the remote ticket branch was deleted. The implementation is complete; the
+ticket remains active only as the governance owner of the post-merge README,
+changelog and roadmap reconciliation in this follow-up publication.
+
 ## Participants
 
 - Human participant: unresolved; no user-* file was created by this script.
diff --git a/project/ticket-001/ai-codex-logs.txt b/project/ticket-001/ai-codex-logs.txt
index fd5ed11..eea3356 100644
--- a/project/ticket-001/ai-codex-logs.txt
+++ b/project/ticket-001/ai-codex-logs.txt
@@ -3,3 +3,7 @@
 2026-09-01T07:57:08Z IMPLEMENTATION commit=ece3208 runtime=Dockerfile e2e=Dockerfile.e2e compose=3
 2026-09-01T07:57:08Z VALIDATION runtime=pass focused="77 passed; 183 passed" container="1683 passed, 23 skipped" host="1697 passed, 9 skipped"
 2026-09-01T07:57:08Z PUBLICATION governance=pass protected-review=pending
+2026-09-01T10:51:23Z PUBLICATION validator_run=33489354617 exact_head=d7ff12cb98cd86510320f1e9d8e41f3161c423d4 merge=1125743e4854eed84c3ee7c6b0a5d17c572fd16f branch_deleted=true
+2026-09-01T10:51:23Z DOCUMENTATION reconciliation=active owner=ticket-001 post_merge_ci=pass
+2026-09-01T10:51:23Z SESSION_EXECUTION_AUTHORIZATION user="kontynuuj i zaktualizuj dokumentacje" scope="README.md CHANGELOG.md TODO.md publication records"
+2026-09-01T10:51:23Z INTENT allowed_path_added=README.md workstream=governance
diff --git a/project/ticket-001/ai-codex.md b/project/ticket-001/ai-codex.md
index 3fdd849..d188d22 100644
--- a/project/ticket-001/ai-codex.md
+++ b/project/ticket-001/ai-codex.md
@@ -46,7 +46,18 @@ was reported, is `SESSION_EXECUTION_AUTHORIZATION` for this bounded repair.
   resource regressions, full container/Compose `1683 passed, 23 skipped`, host
   `1697 passed, 9 skipped`, all Compose configs and governance.
 
-## Blockers
+## Publication
 
-- Implementation has no technical blocker. Publication still requires the
-  repository's protected review bound to the final HEAD.
+- Validator approved exact HEAD `d7ff12cb98cd86510320f1e9d8e41f3161c423d4`.
+- PR #7 was merged as `1125743e4854eed84c3ee7c6b0a5d17c572fd16f`.
+- Required post-merge CI passed and the remote branch was deleted.
+
+The implementation publication is complete. The ticket remains active only
+through the protected follow-up that reconciles root documentation with the
+published Docker and binary-response work; a governance-only follow-up will
+then mark it `DONE`.
+
+The user's explicit request to update documentation is
+`SESSION_EXECUTION_AUTHORIZATION` for this follow-up. The intent adds only the
+previously omitted root `README.md`; that path already belongs to the
+`governance` workstream, and no executable or shared-contract scope is added.
diff --git a/project/ticket-001/changelog.md b/project/ticket-001/changelog.md
index 95d0e11..4ae1da8 100644
--- a/project/ticket-001/changelog.md
+++ b/project/ticket-001/changelog.md
@@ -11,3 +11,9 @@
   Compose files execute the E2E image.
 - Passed the complete host and container test suites; moved the ticket to
   publication pending protected review.
+- Recorded protected approval, merge `1125743e4854`, successful post-merge CI
+  and deletion of the remote branch; retained the ticket as the active owner
+  of the bounded post-merge documentation reconciliation.
+- Recorded explicit documentation authority and added the already
+  governance-owned root `README.md` to the ticket's previously incomplete
+  allowed path list.
diff --git a/project/ticket-001/intent.json b/project/ticket-001/intent.json
index ef6a22e..83b0062 100644
--- a/project/ticket-001/intent.json
+++ b/project/ticket-001/intent.json
@@ -16,6 +16,7 @@
     "project/readme.sh",
     ".governance/**",
     "AGENTS.md",
+    "README.md",
     "VERSION",
     "CHANGELOG.md",
     "TODO.md",
diff --git a/project/ticket-002/README.md b/project/ticket-002/README.md
index a4c49f8..41587e2 100644
--- a/project/ticket-002/README.md
+++ b/project/ticket-002/README.md
@@ -2,7 +2,7 @@
 
 - **ID**: ticket-002
 - **Owner**: unresolved:human
-- **Status**: IN_PROGRESS
+- **Status**: DONE
 - **Workflow state**: PUBLICATION
 - **Created**: 2026-09-01
 
@@ -58,7 +58,17 @@ extendable manifest.
 The repository-authored Docker packaging blocker was resolved independently by
 ticket-001 and merged through PR #7. Ticket-002 was resumed and fully validated
 on top of that exact `main` revision without taking ownership of Docker or
-Compose paths. The ticket is ready for protected publication.
+Compose paths.
+
+## Publication evidence
+
+Validator approved exact HEAD `fe28201fd6d518da7aa38ae9e221904ffa26798e`
+after two stable policy reads and merged
+[PR #6](https://github.com/autogrammar/testql/pull/6) as
+`6b80259dadaee4738bf97d77ecd90b6f9a64f8f6`. Required post-merge CI passed in
+9m15s and the remote ticket branch was deleted. The unrelated organization
+metadata dispatch failed because its workflow received no authentication
+token; this did not affect TestQL validation or publication.
 
 ## Participants
 
diff --git a/project/ticket-002/ai-codex-logs.txt b/project/ticket-002/ai-codex-logs.txt
index a391085..c4499b6 100644
--- a/project/ticket-002/ai-codex-logs.txt
+++ b/project/ticket-002/ai-codex-logs.txt
@@ -12,3 +12,7 @@
 2026-09-01T09:29:23Z DOCKER runtime_build=pass runtime_start="TestQL 1.2.67" e2e_build=pass e2e="1690 passed, 23 skipped"
 2026-09-01T09:29:23Z INTEGRATION viewer_live="59/59 passed" endpoint="http://127.0.0.1:8088"
 2026-09-01T09:29:23Z PUBLICATION ready=true pr=6
+2026-09-01T10:51:23Z PUBLICATION validator_run=33495507788 exact_head=fe28201fd6d518da7aa38ae9e221904ffa26798e merge=6b80259dadaee4738bf97d77ecd90b6f9a64f8f6 stable_reads=2 branch_deleted=true
+2026-09-01T10:51:23Z VALIDATION post_merge_ci=33495661393 outcome=pass duration=9m15s
+2026-09-01T10:51:23Z INFRA metadata_sync=33495661394 outcome=fail reason="token or opts.auth required" required_check=false
+2026-09-01T10:51:23Z DONE ticket=ticket-002
diff --git a/project/ticket-002/ai-codex.md b/project/ticket-002/ai-codex.md
index 33150ff..73fbad1 100644
--- a/project/ticket-002/ai-codex.md
+++ b/project/ticket-002/ai-codex.md
@@ -66,3 +66,14 @@ to the `core` workstream.
 Ticket-002 completed `VALIDATION` on the combined tree and moved to
 `PUBLICATION`. It does not modify or claim ownership of the Docker, Compose or
 root roadmap files brought in from `main`.
+
+## Publication
+
+- Validator approved exact HEAD `fe28201fd6d518da7aa38ae9e221904ffa26798e`
+  after two stable reads.
+- PR #6 was merged as `6b80259dadaee4738bf97d77ecd90b6f9a64f8f6`.
+- Required post-merge CI passed in 9m15s and the remote branch was deleted.
+- The separate organization metadata dispatch lacked its token; it was not a
+  required TestQL check and did not change the publication verdict.
+
+The implementation and publication are complete.
diff --git a/project/ticket-002/changelog.md b/project/ticket-002/changelog.md
index f9b2b8c..ae0c89f 100644
--- a/project/ticket-002/changelog.md
+++ b/project/ticket-002/changelog.md
@@ -22,3 +22,7 @@
   mypy, all Compose configurations, managed governance, both container builds,
   the full E2E image suite and the live Viewer scenarios.
 - Completed every acceptance criterion and moved the ticket to `PUBLICATION`.
+- Recorded Validator approval of the exact HEAD, merge `6b80259dadae`, green
+  post-merge CI and remote branch deletion; closed the ticket as `DONE`.
+- Kept the unauthenticated organization metadata dispatch visible as an
+  unrelated infrastructure failure rather than presenting it as a code test.