docs(audit): reconcile Phase 10 findings on Phase 9.5, Infisical, and website pricing

Phase 9.5: reconfirmed no canonical commit exists (broader content search across full history —
still zero hits outside this session's own commits); Chase confirmed the real document lives on
PC #2, unpushed. Not duplicated here per Chase's explicit instruction — he owns bringing it to
canonical Gitea.

Infisical: Phase 10's 'project does not exist' finding was incomplete, not wrong about what it
checked — a proper org-scoped API enumeration (8 projects) still shows no RootNode Academy
project visible to the claude-code-migration machine identity, even though Chase confirms it
exists. Root cause narrowed to a missing per-project access grant (Infisical scopes identity
visibility per-project, separate from org membership) rather than the project not existing.
Corrected docs/SECRETS_AND_INFISICAL.md and docs/PHASE10_CANONICAL_STATE_AUDIT.md accordingly,
with the exact one-step fix (grant the identity access via Project Settings -> Access) and the
identity id needed to do it. No duplicate project was created.

Website pricing: a read-only fetch of rootnodeacademy.com found stale founding-price RANGES that
don't match the exact fixed V1 prices Chase gave directly this phase; Chase confirmed the fixed
prices in this repo's docs are correct and current. Noted as a real discrepancy for his own
awareness, not something this repo's scope covers fixing.

Updated the Phase 10 launch matrix with a Category column (TECHNICAL READY / OWNER DECISION
REQUIRED / EXTERNAL BLOCKER / HARDWARE BLOCKER) distinguishing who needs to act on each
remaining gate. No application code changed — audit/documentation reconciliation only.

docs/PHASE10_CANONICAL_STATE_AUDIT.md

@@ -81,16 +81,27 @@ verified present in canonical history, in full agreement with the commit message
 | 9.1 (prep) | `77fd186` | docs(stripe): document Phase 9.1 blocked status and live-mode readiness checklist |
 | 9.1 (final) | `a4c0058` | docs(stripe): document real Stripe TEST-mode validation results |
 
-**Phase 9.5 — NOT FOUND.** No commit, branch, or tag matching "Phase 9.5" or a founder-pricing
-document exists anywhere in this repository's reachable history (`git log --all` contains no
-such commit), and no `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md` file exists at any point in
-history. This exact discrepancy was already surfaced during Phase 9.1 (Chase explained it was
-done on the desktop PC, separate from this laptop) — §1.3's commands above are how to confirm
-whether that work is sitting unpushed on PC #2, or whether it was a decision made directly rather
-than a planned commit. **The founder-approved pricing itself ($399 launch / $449 standard,
-39900/44900 cents, "Founding Cohort," paid in full, no deposit) was given directly by Chase in
-conversation and used for Phase 9.1's real Stripe validation and this phase's documentation — it
-did not require a committed document to act on, and is not invented by this phase.**
+**Phase 9.5 — NOT FOUND, reconfirmed in Phase 10.1.** No commit, branch, or tag matching "Phase
+9.5" or a founder-pricing document exists anywhere in this repository's reachable history
+(`git log --all` contains no such commit, searched again in Phase 10.1 with a broader content
+search for "FOUNDER APPROVED"/"LOCKED FOR V1"/"Founding Cohort"/`39900` — every hit traces to
+this session's own Phase 9.1/10 commits, never a separate Phase 9.5 one), and no
+`docs/ROOTNODE_PRICING_AND_OFFERS_V1.md` file exists at any point in history. **Phase 10.1
+confirmed directly with Chase**: the real Phase 9.5 pricing document already exists — on PC #2,
+not yet brought to canonical Gitea. Per Chase's explicit instruction this phase, no duplicate
+was written here; Chase will bring the real document to canonical Gitea himself. §1.3's commands
+below are how to confirm/complete that from PC #2. **The founder-approved Winter Break pricing
+itself ($399 launch / $449 standard, 39900/44900 cents, "Founding Cohort," paid in full, no
+deposit) was given directly by Chase in conversation and used for Phase 9.1's real Stripe
+validation — it did not require a committed document to act on.**
+
+**Website pricing is stale, confirmed with Chase.** A read-only fetch of `rootnodeacademy.com`
+during Phase 10.1 found founding-price RANGES (INIT_ $200–250, COMPILE_ $300–360, ROOT_
+$550–650, CAMPS_ $250–350 — no specific "Winter Break Camp" named, no ROOT_ tier breakdown) that
+do not match the exact fixed V1 prices Chase gave directly this phase. Chase confirmed the exact
+fixed prices are the correct, current figures — **the live website has not yet been updated to
+the real V1 pricing matrix.** This is the separate, not-RootNode-owned website repo; updating it
+is outside this repo's scope, noted here only as a real discrepancy for Chase's own awareness.
 
 ## 1.5 File/artifact audit
 
@@ -139,15 +150,25 @@ status.
 
 ## Discrepancies found
 
-1. **"Phase 9.5" has no canonical commit** — see §1.4. Not a blocker (the pricing decision was
-   usable directly), but flagged so it isn't assumed to exist in code review later.
-2. **Chase's Phase 10 authorization states "Chase has ALREADY created RootNode Academy" as an
-   Infisical project** on `infisical.cedshomelab.com` — verified NOT present. The organization
-   ("Ceds HomeLab") has exactly six existing projects (Core Infrastructure, Hermes Fleet,
-   Kubernetes, Media Platform, Monitoring, Network Service), none named RootNode Academy or
-   similar. See `docs/SECRETS_AND_INFISICAL.md` §"Project status" for the full finding and what
-   Chase needs to do (create the project via the Infisical web dashboard — the CLI has no
-   non-interactive project-creation command).
+1. **"Phase 9.5" has no canonical commit** — see §1.4, reconfirmed in Phase 10.1. Not a blocker
+   (the pricing decision was usable directly), and Chase confirmed the real document exists on
+   PC #2 — it just hasn't reached canonical Gitea yet. Not invented/duplicated here.
+2. **Chase's Phase 10.1 authorization states RootNode Academy "ALREADY EXISTS" as an Infisical
+   project** on `infisical.cedshomelab.com`. Re-investigated in Phase 10.1 with a proper
+   org-scoped API enumeration (`GET /api/v2/organizations/{orgId}/workspaces`, not just the
+   CLI's interactive picker, which turned out to be incomplete — it showed 6 projects in Phase
+   10, the API shows 8 for the same identity). **Still no project named "RootNode Academy" (or
+   similar) is visible to this machine identity** even with the more complete method — the
+   full, real list is: Core Infrastructure, Kubernetes, Media Platform, Monitoring, Network
+   Service, Privileged Access Manager, Storage, Synthos Systems. **Root cause is now narrowed,
+   not fully resolved**: this machine identity's own project list only shows projects it has
+   been explicitly granted access to (standard Infisical per-project ACL, separate from org
+   membership) — so the most likely explanation is that "RootNode Academy" exists but this
+   identity was never added to it, not that it doesn't exist. This cannot be distinguished from
+   here without either org-owner-level API access or the web dashboard, neither available to
+   this session. **No duplicate project was created.** See `docs/SECRETS_AND_INFISICAL.md` for
+   the exact one-line fix (grant the `claude-code-migration` identity access to the existing
+   project via its Project Settings → Access page).
 3. **No dedicated production server/Proxmox VM has been provisioned** — `infra/terraform/` has
    no `terraform.tfvars` (only `.example`) and no state file; `infra/ansible/group_vars/
    production.yml` still holds literal placeholders (`__PLATFORM_VM_IP__`,