docs: add the #590 spy-cascade isolation fix to the §5.2 delivery log

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

Author: claude

docs/audits/AUDIT_2026-06-10.md

@@ -194,7 +194,8 @@ pre-existing #554), a dedup idempotence
 fix found by a new identity property suite (#579), an unused
 devDependency removal (#581), the closing batch of the §4.2 retry
 consolidation (#585), the two §4.3 typed-error slices (#586, #587), and
-the knowledge-base refreshes (#588 for test/, #589 for lib/).
+the knowledge-base refreshes (#588 for test/, #589 for lib/), and a
+spy-cascade isolation fix in the storage suite (#590).
 (The number sequence skips #558 and #562, which are issues — the knip CI
 tracking issue and a maintainer MCP-auth test — not PRs; it also skips
 #568, which is the PR delivering this very section.)
@@ -230,6 +231,7 @@ tracking issue and a maintainer MCP-auth test — not PRs; it also skips
 | [#587](https://github.com/ndycode/codex-multi-auth/pull/587) | `lib/config.ts` + config-save typed-abort test | second §4.3 slice (M11), unblocked by #585: the three unreadable-config save aborts in `savePluginConfig` throw `StorageError` (UNREADABLE code, config path, actionable hint, classifier cause) with byte-identical messages; with #586 this clears every bare throw from the files §4.3 names |
 | [#588](https://github.com/ndycode/codex-multi-auth/pull/588) | `test/AGENTS.md`, `test/README.md` | refreshes the test knowledge bases the wave left stale: headline counts corrected (3847/257 and 2071/87 → the actual 4909 tests / 317 files) and the curated trees gain the wave's load-bearing new suites plus the three fast-check property suites |
 | [#589](https://github.com/ndycode/codex-multi-auth/pull/589) | `lib/AGENTS.md` | companion refresh for the lib knowledge base: the STRUCTURE tree gains the extraction-era clusters (`codex-manager/formatters/`, `request/helpers/` + decision/failover modules, `runtime/rotation-*`, `policy/`, `fs-retry`, `temp-path`, `budget-guard`, `local-bridge`) and WHERE TO LOOK points at the shared retry and temp-path helpers |
+| [#590](https://github.com/ndycode/codex-multi-auth/pull/590) | `test/storage.test.ts` | isolation hardening for a contamination class found while writing #585's tests: a test failing before its inline `mockRestore()` leaks its fs spy, and a later `vi.spyOn` returns the same leaked spy so passthrough bindings recurse into the new test's own mock; the suite's top-level afterEach now calls `vi.restoreAllMocks()` |
 
 ---