docs(phase-10): record RTVAL-01 PASS on re-test with fixed .intunewin build

- Flip RTVAL-01 from FAIL to PASS after re-test against live tenant rubis.fr
- Reference evidence screenshots (tenant-upload, app-assigned)
- Fix Package SHA256 (strip trailing garbage) to 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc
- Update top-level Status to IN PROGRESS; plan 10-02 resumed at Task 2
- Resolve ISSUE-01 (fixed in 74535ea HMAC scope + 7716246 Detection.xml alignment)
- Lock package to ImpTune commit 00b709d

.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md

@@ -1,6 +1,6 @@
 # Runtime Validation Report — ImpTune v1.1
 
-**Status:** BLOCKED — RTVAL-01 FAIL; plan 10-02 stopped at task 1; gap-closure required before resuming
+**Status:** IN PROGRESS — RTVAL-01 PASS on re-test (2026-04-13) against fixed build; plan 10-02 resumed at Task 2 (RTVAL-02 on-device install)
 **Started:** 2026-04-13
 **Signed off by:** <name>
 **Signed off date:** <YYYY-MM-DD>
@@ -8,24 +8,25 @@
 ## Tenant & Environment
 | Field | Value |
 |-------|-------|
-| Intune tenant (domain) | arescom.fr |
+| Intune tenant (domain) | rubis.fr |
 | Test device hostname | ARES-5CG5220YTM |
 | Windows OS build | 26200.7171 |
 | Device is Intune-managed | yes |
 | Driver vendor(s) tested | ricoh.zip
  - PCL6 Driver for Universal Print |
-| ImpTune commit SHA | 1c3f458583d826bdcde7ffa5192de6f2fb8e1202 |
+| ImpTune commit SHA | 00b709d25aa20a3d5fbdabb728f6083d4f9f958c |
 | Package file name | Copieur_2eme.intunewin |
-| Package SHA256 | 0aac31ff190d21cbb4c76a81d4ad32657a5a3298e7e3fcc79a080e87cf40c333 |
+| Package SHA256 | 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc |
 | Generated at | 2026-04-13 |
 
 ## RTVAL-01 — Tenant ingestion
-Status: FAIL
-Tested: 2026-04-13
-Evidence: No screenshot captured — the Intune upload form never reached a populated state. UI remained empty; there was no visible error banner to screenshot.
-Verbatim symptom (technician): "The intunewin package cant be uploaded, the OK button is greyed out and none of the fields (name, platform, size, mam enabled) gets populated."
-Interpretation: Intune accepted the file transfer but was unable to parse its embedded Detection.xml / package metadata. The Win32 app creation wizard stalls in this state when the .intunewin content manifest is malformed or when the embedded `detection.xml` is missing or structurally invalid. This is a structural defect in the package that ImpTune is generating — exactly the runtime gap RTVAL-01 is designed to catch. No portal error banner was shown because the failure occurs silently during client-side metadata extraction.
-Package tested: Copieur_2eme.intunewin (SHA256 0aac31ff190d21cbb4c76a81d4ad32657a5a3298e7e3fcc79a080e87cf40c333, ImpTune commit 1c3f458)
+Status: PASS
+Tested: 2026-04-13 (re-test against fixed build)
+Evidence:
+- evidence/rtval-01-tenant-upload.png — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled)
+- evidence/rtval-01-app-assigned.png — app assignment screen showing the test device group
+Notes: Initial run on 2026-04-13 failed with empty wizard fields and greyed-out OK button (see ISSUE-01). Root cause was two structural defects in the .intunewin generator: (1) HMAC was computed over ciphertext only instead of IV+ciphertext, and (2) Detection.xml did not match the IntuneWinAppUtil.exe reference format. Both fixed in commits 74535ea and 7716246. Re-test on the fixed build against live tenant rubis.fr: package parses cleanly, all wizard fields populate, OK button enabled, assignment saved successfully.
+Package tested: Copieur_2eme.intunewin (SHA256 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc, ImpTune commit 00b709d)
 
 ## RTVAL-02 — Install under SYSTEM (pnputil + $PSScriptRoot)
 Status: BLOCKED — depends on RTVAL-01 PASS; RTVAL-01 returned FAIL (Intune cannot parse generated .intunewin). Cannot proceed until package structure defect is resolved.
@@ -52,7 +53,7 @@ Notes:
 - **Affected file:** Copieur_2eme.intunewin (evidence/Copieur_2eme.intunewin)
 - **Affected code:** ImpTune .intunewin generator (commit 1c3f458)
 - **Resolution path:** Debug the generator to verify Detection.xml is being created, embedded, and follows the expected Intune Win32 app manifest schema. Recommended: run `/gsd:debug` on the .intunewin generator, OR let phase verification surface this as a gap and use `/gsd:plan-phase 10 --gaps` to draft a gap-closure plan.
-- **Status:** Open — plan 10-02 stopped; gap-closure cycle required before retesting
+- **Status:** Resolved in commits 74535ea (HMAC over IV+ciphertext) and 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format). Re-tested 2026-04-13 against live tenant rubis.fr — package now parses; wizard fields populate; OK button enabled.
 
 ## Sign-off
 - [ ] All five RTVAL criteria PASS or have documented rationale