docs(plans): record deleted-test and vacuous-gate audit findings

Record the 2026-07-27 audit in the authoritative V2 status files.

Three delivered claims (Plan 16 worktree/store identity, Plan 38 cursor
repair, Plans 18/23 end-to-end sanitization) lost their tests in
9e3ca9f. Filed as verification-coverage corrections, not retractions:
the assertion is missing, the behavior is not withdrawn.

Also record the six instances of gates attesting to something they never
checked, the libtest empty-filter asymmetry that hides them, the six
product defects fixed tonight with their SHAs, and Plan 11's corrected
open-gap list including two items the widened accessibility matrix
surfaced.

None of tonight's commits has CI validation: PR #421 has been
conflicting since 05:13 UTC, so no CI has run since 01:24 UTC. Every
fix is recorded as locally verified only.

Author: ScriptedAlchemy

docs/plans/tracedecay-v2/00-plan-set-index.md

@@ -110,6 +110,16 @@ suite.
   been measured because no full suite run has completed. The active PR12/PR13
   stabilization slice owns reducing that uncertainty and reporting the next
   full run truthfully; no PR9–PR14 acceptance follows from focused green suites.
+- No CI has run since 01:24 UTC on 2026-07-27. PR #421 has been conflicting
+  since 05:13 UTC, and `pull_request` workflows cannot build a merge ref for a
+  conflicting pull request, so roughly 60 commits — the entire 2026-07-27 night
+  batch of repairs included — are verified only by scoped, contended local runs.
+  Nothing in that batch may be reported as CI-validated.
+- Commit `9e3ca9fd2` deleted 124 first-party tests, 75 of which cover behavior
+  that still ships, and three of those intersect claims recorded as delivered.
+  `GAP-LEDGER-PR8-PR14.md` records them as verification-coverage corrections
+  rather than retractions, together with the six instances of gates that
+  attested to something they never checked.
 
 Completed-slice names are historical implementation evidence, not instructions
 to recreate a type, file layout, fixture filename, milestone, or gate. A deleted
@@ -120,6 +130,12 @@ missing callable behavior or a missing direct regression is a product gap.
 Removed planning/evidence machinery is not unfinished product work and must not
 be rebuilt.
 
+That rule protects deleted scaffolds, not deleted assertions. A direct test that
+covered retained shipping behavior is exactly the "missing direct regression"
+case above, so the 2026-07-24 deletions are a restoration backlog against
+known-good prior coverage. Restoring them changes no delivered claim and
+authorizes no reimplementation of the behavior they asserted.
+
 ## Delivery rules and practical safety baseline
 
 Every remaining PR must leave a supported user journey working through a real

docs/plans/tracedecay-v2/11-dashboard-frontend.md

@@ -74,13 +74,23 @@ audit against the requirements below found these still unmet. They are
 recorded so acceptance is not claimed early. They are capability/test gaps, not
 permission to replace unavailable data with fabricated values.
 
-- **PR14 / Plan 11 owner:** the runtime performance budgets (LCP, frame p95,
-  heap retention, SSE sustain), AST import-boundary rules, and MSW fault
-  injection inside Vitest remain absent. The transfer budgets and the
-  virtualization mount ceiling are now enforced — see the closure below.
-- **PR14 / Plan 11 owner:** the viewport matrix is partial. Current audits cover
-  320/768/1440 in light and dark, but not 390×844, 1024×768, 1280×720,
-  200%/400% zoom, `prefers-contrast: more`, or forced colors.
+- **PR14 / Plan 11 owner:** the runtime performance budgets — LCP, frame p95,
+  and heap retention — remain absent. MSW HTTP fault coverage, the ast-grep
+  renderer boundary gate, the SSE churn bounds, the transfer budgets, and the
+  virtualization mount ceiling have all since landed and are no longer open.
+- **PR14 / Plan 11 owner:** the 200 ms p95 input budget is unasserted and will
+  stay that way here. It cannot be measured deterministically in jsdom, which
+  has no layout or paint, so a jsdom timing assertion would be a gate attesting
+  to something it never checked. It belongs in Playwright against a real engine,
+  alongside the runtime budgets above.
+- **PR14 / Plan 11 owner:** a collapsed scroller hides content at 320 px width
+  and 400% zoom while the header still states a row count — the count is
+  truthful but the rows it counts are unreachable, which reads as falsified UI
+  to anyone at that viewport.
+- **PR14 / Plan 11 owner:** 18 controls render below the 44×44 minimum target
+  size. The cause is `html { font-size: 14px }`, which makes every rem-based
+  utility resolve smaller than its token intends — a nominal 44 px control
+  renders at 38.5 px.
 - **PR14 / Plan 11 owner:** Code still lacks diagnostics, affected tests, code
   health, and branch-aware freshness; Agents lacks its PR14 subagent/handoff
   context; Sessions lacks raw-message drill-down, compaction boundaries, and
@@ -97,6 +107,24 @@ permission to replace unavailable data with fabricated values.
   belongs to the executable Work/handoff journey and does not block the PR14
   twelve-workspace checkpoint.
 
+**Accessibility matrix widened (2026-07-27).** The viewport matrix is no longer
+partial. The accessibility audit now covers the full specified set — the added
+390×844, 1024×768, and 1280×720 viewports, 200% and 400% zoom,
+`prefers-contrast: more`, and forced colors — across 460 scans. That closes the
+partial-matrix gap this section carried until now.
+
+The two new open items in the list above exist because of that widening: both
+the collapsed 320 px / 400% scroller and the 18 undersized controls were
+invisible to the narrower matrix and appeared on its first widened run. This is
+the ordinary consequence of a gate that now checks more, not a regression
+introduced by it. A lane is in flight on both; they stay recorded as open until
+the repairs land, and a claim that they are fixed must cite the landing commits.
+
+Every closure in this section was verified by scoped local runs. None has been
+validated by CI: no CI has run since 01:24 UTC on 2026-07-27 because PR #421 is
+conflicting. See the verification-status section of
+[`GAP-LEDGER-PR8-PR14.md`](GAP-LEDGER-PR8-PR14.md).
+
 **Transfer budgets and list bounds closed (2026-07-27).** The two payload
 ceilings this plan states are now measured and enforced by
 `scripts/check-dashboard-budget.mjs`, run in the `dashboard-assets` CI job and

docs/plans/tracedecay-v2/GAP-LEDGER-PR8-PR14.md

@@ -29,6 +29,10 @@ not inherited merely because the superseded branch entered history.
   cadence is suspect after a 237-minute stale observation, roughly eight known
   test failures remain, and roughly 4,169 tests have never been measured in a
   completed full-suite run.
+- No CI has run since 01:24 UTC on 2026-07-27 because PR #421 has been
+  conflicting since 05:13 UTC. Roughly 60 commits, including every repair
+  recorded below, are locally verified only. See the verification-status section
+  below before treating any of them as proven.
 - Plan 32 is PR17-only and SCOPE-OUT for PR8–PR14 audits.
 - Plan 34 is split: the published read-only rename preview is implemented and
   reachable; apply-grade rename is not certified by that preview, and the
@@ -237,6 +241,131 @@ No numbered plan claims `.tracedecay/domain-symbols.toml` as a delivered
 capability, so the no-op `DOMAIN-EXTRACTORS.md` proposal requires no plan-side
 correction.
 
+## Verification status of the 2026-07-27 night commits
+
+Everything recorded in the three sections below landed on
+`codex/tracedecay-total-redesign-plan` during the night of 2026-07-27. **None of
+the 24 commits has been validated by CI.** PR #421 has been in a conflicting
+state since 05:13 UTC, and `pull_request` workflows cannot build a merge ref for
+a conflicting pull request, so no CI run has started since 01:24 UTC — a gap now
+covering roughly 60 commits. `gh pr view 421` still reports
+`mergeable: CONFLICTING`.
+
+Local verification during that window was scoped and contended. Several lanes
+committed on `cargo check` plus a filtered test run rather than a completed
+suite. Where a fix below is described as fixed, that means the repair landed and
+its author observed a scoped local run — not that the repository's aggregate
+gates agree. No claim here upgrades the delivery band, which remains not green
+per the authority section above.
+
+## Verification-coverage corrections (2026-07-27)
+
+Commit `9e3ca9fd2` (2026-07-24, 617 files changed) deleted 124 first-party
+tests. 75 of those covered behavior that still ships. Three of them intersect
+claims this ledger or its numbered plans record as **delivered**.
+
+These are **verification-coverage corrections, not retractions**. Nothing here
+withdraws a delivered claim, and no audit may cite this section as evidence that
+the underlying behavior is broken or must be reimplemented. The behavior may
+well be correct. What is missing is the assertion that it is. A later audit's
+only licensed action is to restore or replace the coverage — never to reopen the
+capability as unbuilt.
+
+- **Plan 16 — worktree/store identity.** The corrections list states that linked
+  worktrees "collapse to primary-checkout project/store identity while retaining
+  exact worktree snapshot authority". The mechanism enforcing the immutable half
+  of that is the `store_instances_project_immutable_v1` trigger, and its test
+  `store_project_identity_cannot_be_reparented` was among the deletions. Between
+  2026-07-24 and 2026-07-27 nothing asserted that the trigger fires. `b8ef48ec5`
+  restored it, together with the cross-table identity-constraint and
+  sanitization-receipt-immutability tests. Three restored tests against 67
+  declared guards is a partial restoration, not closure.
+- **Plan 38 — `source_cursor_advances` reclamation.** The corrections list
+  states that superseded advances are reclaimed "while preserving the current-
+  frontier receipt and restoring the immutable delete trigger before commit".
+  The adjacent recovery logic in
+  `src/global_db/schema_contract/invariants/repair.rs` — 391 lines that run on
+  every reopen and can rewind cursors and requeue projection suffixes — lost all
+  nine of its tests in the same commit and currently has zero. The retention
+  transaction's own coverage is a separate question from this one; what is
+  unasserted is the repair path that can move the same cursors outside it.
+- **Plans 18 and 23 — end-to-end sanitization.** Plan 18 lists structural
+  sanitization as delivered and Plan 23 requires every imported row to carry a
+  verified sanitization receipt. `tests/session_suite/temporal_privacy.rs` (1,081
+  lines) was deleted outright, taking the three end-to-end tests that a redacted
+  value cannot resurface through temporal summary, context, reopen, or rebuild
+  replay. Unit sanitization coverage in `src/privacy/tests.rs` survives, so the
+  detector and sanitizer are still asserted; the end-to-end non-resurfacing
+  property is not. The fixtures those tests consumed are still on disk, so
+  restoration does not require regenerating inputs.
+
+### Structural residue of the same deletion
+
+Three files carrying schema-enforcement and registry authority were left with no
+direct test coverage at all, and two of them still are:
+
+- `src/global_db/schema_contract/invariants/triggers.rs` — 67 `RAISE(ABORT)`
+  guards across roughly 1,800 lines of trigger definitions, of which three are
+  asserted by the module `b8ef48ec5` restored and 64 are not;
+- `src/global_db/schema_contract/invariants/repair.rs` — 391 lines, zero tests;
+- `src/global_db/project_registry.rs` — 1,691 lines, zero tests.
+
+The cause was mechanical rather than a judgement that the coverage was
+worthless: a `GlobalDb` → `RegisteredGlobalDb` refactor whose compile breaks were
+cleared by deleting callers. The evidence is that 20 tests in the same file were
+successfully re-pointed at the new type while 63 were deleted. A later audit
+should treat this as a restoration backlog against known-good prior assertions,
+not as new test design.
+
+## Gates that attest to what they never checked
+
+Six independent lanes each found the same failure family on 2026-07-27: a gate
+that reports success without having exercised the thing it names. Recording the
+family so future gate review looks for it directly.
+
+1. `windows-pr8-temporal-durable` filtered on
+   `binary(=session_suite) & test(/^lcm_schema::/)`, which matched zero tests
+   while the job reported green. 30 LCM schema tests had never run under the
+   Windows DELETE+FULL pragmas the job exists to cover. Fixed in `7a92b147a`.
+2. `platform_lifecycle.passed` receipts were written unconditionally on two
+   operating systems, under a comment claiming they proved a test had run. Fixed
+   in `2758e5b97`.
+3. `pr13_lite_grammar_contract` was satisfiable by all-features junit evidence
+   without the lite build ever running. Fixed in `6b0417935`.
+4. MCP fixtures wired test doubles into test doubles, and `production_joins.rs`
+   has no production implementor — the seam is proven only against itself.
+5. `pr13_advisory_proximity_overlap` filtered on a test deleted a month earlier,
+   which reddened the `test` job at HEAD. Fixed in `3ec8f086b`.
+6. `tests/pr12_production_reachability.rs` asserts that a symbol *name appears
+   in source text* rather than that the path executes. That is why symbol-graph
+   pagination was dead from the day it was written without any gate noticing.
+
+The asymmetry that hides this family: **libtest exits 0 when a name filter
+matches nothing, while nextest can be made to fail on an empty filter.** A
+dangling `cargo test --exact` is therefore silently vacuous forever, and stays
+green through the deletion of the very test it names. Treat a name-filtered gate
+as unverified until something proves the filter selects a nonempty set.
+
+## Product defects found and fixed 2026-07-27
+
+Each landed with scoped local verification only; see the CI-status section
+above.
+
+- Symbol-graph pagination failed any read exceeding one page, from the day it
+  was written — `e864c9bf1` binds the cursors to a derived digest.
+- macOS and Windows could not mount a store at all, because the
+  filesystem-locality classifier was Linux-only — `2edeee16c`, cross-checked on
+  four target triples.
+- `test_map` reported well-tested functions as untested when a graph read
+  failed, presenting a failure as an empty success — `e56c1cc6c`.
+- SSE renders were never coalesced, producing roughly 1,000 renders/s against a
+  stated ceiling of ten, and one queue overflow fired eleven invalidations —
+  `e402d6cfe`.
+- Route grant identity was not request-correlated, and `storage_status` wrote a
+  history row on every read — `5d2a6d4b9`.
+- LSP refused to project context for any freshly bootstrapped project —
+  `f3135e9f7` projects degraded feedback instead.
+
 ## Refuted defect claims — do not reintroduce
 
 - Plan 35's current capability advertisement is honest; it is not a missing

docs/plans/tracedecay-v2/NEXT.md

@@ -72,6 +72,25 @@ the usability study. See
 - Roughly eight known test failures remain, and roughly 4,169 tests have not
   been measured because no full suite has completed. Focused green runs and the
   failure-fix clusters landed today do not satisfy the aggregate gate.
+- CI has not run since 01:24 UTC. PR #421 has been conflicting since 05:13 UTC,
+  and `pull_request` workflows cannot build a merge ref for a conflicting pull
+  request, so roughly 60 commits — including the whole 2026-07-27 night batch —
+  carry scoped local verification only. Restoring a mergeable PR #421 is a
+  precondition for any aggregate claim about this slice.
+- Six independent lanes found the same failure family on 2026-07-27: a gate
+  reporting success without exercising what it names, including a Windows job
+  whose nextest filter matched zero tests and a reachability test asserting that
+  a symbol name appears in source text. Because libtest exits 0 on an empty name
+  filter, a dangling `cargo test --exact` is silently vacuous forever. Gate
+  review for this slice must prove a filter selects a nonempty set before
+  counting the gate as evidence. The ledger records all six.
+- Commit `9e3ca9fd2` deleted 124 first-party tests, 75 of them covering shipping
+  behavior, and three of those intersect claims recorded as delivered — Plan 16
+  worktree/store identity, Plan 38 cursor-repair recovery, and the Plans 18/23
+  end-to-end sanitization property. These are verification-coverage gaps, not
+  retractions: restoring the assertions is the work, and no delivered capability
+  is reopened by them. The ledger names each one and the residual zero-coverage
+  files.
 
 ## Worktree-aware incremental indexing contract