Document CI API availability and historical mincrypt layouts

docs/implementation-status.md

@@ -43,19 +43,30 @@ it should not be read as describing the corrected source unchanged.
 - **S13/S15/S16:** recovered fields, parameter meanings, policy categories, sizes,
   name encoding, borrowed lifetimes, and allocator ownership are documented.
   The opt-in x64 26100 header provides distinct observed layouts and assertions.
-  Default layouts remain compatible; runtime layout identity cannot be inferred
-  from `NTDDI_VERSION` or `ChainInfo->Size` alone.
+  Default declarations retain source compatibility; later chain fields require
+  a confirmed runtime layout. The sampled 1507 chain header is 56 bytes and has
+  no attributes descriptor at +0x38; 1511 uses 72 bytes; 1607–1803 samples use 104.
+  Distinct views are available in `Domito.MinCrypt.Historical.h`. Neither
+  `NTDDI_VERSION` nor total allocation Size identifies the layout.
 
 ## Requires the test VM or additional matching binaries
 
-The VM is not available yet. Host mocks and compilation do not close these:
+Live kernel testing is not available yet. Extracted VM artifacts, host mocks,
+and compilation do not close these:
 
 1. Run the paired `CiValidateFileObject` flag `0`/`0x20` probe on 19041/19045
    with TESTSIGNING off and a loadable signed test driver. Preserve complete
    statuses, policies and fixture/environment identities (issue #3).
-2. Verify historical and ARM64 ABI, structure evolution and first-available
-   export versions using matching binaries/symbols and runtime tests. Preserve
-   default layouts until that evidence supports changing them.
+2. Complete historical and ARM64 ABI/structure verification and runtime tests.
+   The [published export matrix](ci-api-compatibility.md) now covers all ten
+   named APIs across ten exact Windows 10/11 x64 CI files, including 19041.1,
+   19041.1865 and 22000.318 ISO samples. This closes the initial export-presence
+   matrix; additional releases, servicing revisions and architectures remain
+   unsampled. It does not certify ABI or runtime behavior. The six 1507–1803
+   sampled bodies establish the
+   48-byte policy storage and 64-byte hash-capacity gate. Chain constructors
+   establish 56/72/104-byte headers; opt-in views prevent treating 1507 payload
+   as the later attributes descriptor. Unsampled layouts/runtime remain open.
 3. Test real CI policy ownership on every failure/retry path under Driver
    Verifier, including allocation failures and initialized outputs.
 4. Compare real embedded/catalog-only SHA-1/SHA-256 results, catalog cache/reload
@@ -75,5 +86,5 @@ The VM is not available yet. Host mocks and compilation do not close these:
 
 Run the three host runners in `tests/README.md`. Kernel compilation also covers
 the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant,
-and 14 assertions in the opt-in observed-build header. Those are build checks,
+and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks,
 not a claim that historical or ARM64 CI runtime ABI has been verified.