docs: verify phase 0 gate, record desloppify rerun

- CONTRIBUTING.md gains a boot smoke test (live/health/401 checks) and a
  cmd/migrate verification recipe.
- desloppify rerun (ref/ excluded): objective 66.1, strict 16.5 under the
  new scoring model — the subjective review queue (20 items) is unscored,
  so strict is not comparable to the February 89.1.

Authored By: TDvorak <[email protected]>

CONTRIBUTING.md

@@ -26,6 +26,33 @@ templates/      Service template catalog notes
 - Frontend: `cd app/frontend && npm run build && npm test`
 - Compose: `docker compose config -q`
 
+## Boot Smoke Test
+
+Verify the API actually starts and serves against real dependencies:
+
+```bash
+# Requires Postgres + Redis reachable; migrations run automatically on boot.
+cd app/backend
+DATABASE_URL="postgres://user:pass@localhost:5432/containr?sslmode=disable" \
+REDIS_URL="redis://localhost:6379" \
+go run ./cmd/server &
+
+curl -fsS http://localhost:8080/live      # -> 200
+curl -fsS http://localhost:8080/health    # -> {"database":"ok","redis":"ok",...}
+curl -s http://localhost:8080/api/v1/services/x   # -> 401 (auth required, route exists)
+
+kill %1
+```
+
+To verify migrations alone against a scratch database:
+
+```bash
+cd app/backend
+DATABASE_URL="postgres://user:pass@localhost:5432/scratch?sslmode=disable" \
+  go run ./cmd/migrate up
+DATABASE_URL=... go run ./cmd/migrate goose-status
+```
+
 ## Conventions
 
 - Reuse existing utilities before adding dependencies.

ROADMAP.md

@@ -173,10 +173,15 @@ Everything else builds on a truthful API contract and a clean tree.
       entity types in `api-client.ts`.
 - [x] Fix auto-connection edges — `ServiceNode` lacked `Handle` components;
       invisible target/source handles added in `nodes.tsx`.
-- [ ] Rerun desloppify; record score. Target: keep ≥ 89 strict.
+- [x] Rerun desloppify; record score. 2026-09-17 scan (`ref/` excluded):
+      objective **66.1**, strict **16.5** — note the tool's scoring model
+      changed: strict now drags the 75%-weighted subjective pool (20 human
+      review items, all unscored). Mechanical dimensions: code quality 90.7,
+      security 97.0, file health 81.4, test health 35.0. The old "≥89 strict"
+      target is not comparable; treat objective ≥ 70 as the next milestone.
 - [x] `go vet`, `eslint`, `tsc`, `go test`, `vitest`, `vite build` all green;
-      boot smoke verified (`/live`, `/health`, 401s on protected routes).
-      `CONTRIBUTING.md` smoke procedure still to document.
+      boot smoke verified (`/live` → 200, `/health` → db/redis ok, protected
+      routes → 401) and documented in `CONTRIBUTING.md`.
 
 **Gate**: `docker compose up -d` from a clean clone produces a working stack;
 OpenAPI spec matches the router 1:1; zero dead packages.