docs: record Ε-W3 as landed and Phase Ε as complete

docs/COMPLETED.md

@@ -1039,5 +1039,39 @@ genuine folder-name collision (`sanitizeRenameCount` vs `collisionRenameCount`)
 a hostile or foreign-spelled entry name (e.g. an unexpected extension) always
 lands sanitized rather than verbatim.
 
-**Ε-W3 (`package-compat-fixtures`) has not landed** and is the only remaining
-wave of Phase Ε.
+### Ε-W3 — The compatibility fixtures
+
+The phase's third and final wave, and with it Phase Ε's implementation is complete: the
+version-compatibility policy stated in `docs/product/bank-package.md` is now a property
+proven against frozen bytes rather than an assertion in a doc.
+
+**Ε-W3-T1 — `package-compat-fixtures`.** A new checked-in corpus of 23 frozen `.rsbank`
+fixtures under `tests/fixtures/package_compat/` — one v1 package written by the shipping
+build (`1.4.0`), a synthetic additive-forward package (`formatVersion` 2 /
+`minReaderVersion` 1) carrying three keys this build has never heard of, a synthetic
+structural-refusal package (2/2), nine truncations (one per distinct decode failure
+site, including one cut at `additive_forward.rsbank`'s own payload boundary), and eleven
+hostile-name packages (six bad entry names, five bad nested `relativePath` values) —
+every payload a single 300-byte 16-bit mono WAV, ~15 KB for the whole corpus. Two new
+test targets decode and exercise it: `package_compat_tests` (frozen bytes decode to
+exactly what the shipping build wrote, the additive fixture reads with every unknown key
+skipped, every truncation classifies `Malformed` and never `TooNew`, every hostile name
+is refused before any planner runs) and `package_round_trip_tests` (the same corpus
+driven through the actual verbs — export → import → export over `v1_shipping.rsbank`
+yields byte-identical payloads, and every refusal fixture refuses the whole import with
+nothing landed and nothing in the index). A new repo-root `.gitattributes` (`*.rsbank
+binary`) is load-bearing, not decoration: under `core.autocrlf = true`, git's NUL-sniffing
+heuristic would text-classify a future short, ASCII-heavy fixture and CRLF-mangle it on a
+Windows checkout, silently breaking the frozen-bytes premise the whole corpus rests on. A
+standalone DAW verification script, `docs/verify-package-transfer.md`, covers the one
+claim no unit test can make — a real cross-machine transfer, including the too-new
+refusal, the truncated-download refusal, and mid-payload corruption, each read off as an
+exact message string. **Open question resolved:** the recommendation (one-sample
+packages, a few hundred bytes of payload each) was followed — the corpus holds
+one-sample packages with a 300-byte payload each. **Deviation from spec:** the plan
+called for a truncation cut mid-layout; RSBK stores no layout section (the layout is
+derived from the manifest's entries, not stored as its own section), so the fixture that
+exercises "the manifest parses, the layout computes, the exact-size proof fails" lands at
+the payload boundary instead. No production module was touched — the wave adds test-tree
+files, the corpus, its README, the verification script, and one path variable in the root
+`CMakeLists.txt`.