docs: record the direct-coverage wave in the audit delivery log

[ndycode]

Summary

• Doc-only. Adds section 5.2 to docs/audits/AUDIT_2026-06-10.md recording the direct-coverage wave so the audit's delivery log stays the single record of what the roadmap produced.

What Changed

• New §5.2 narrative + thirty-row table: seventeen direct test suites (test: cover login-oauth account selection and cancellation predicates #559, test: cover login-menu manage actions and prompt fallbacks #560, test: cover runAuthLogin transports, org threading, and cap handling #561, test: cover login-menu data layer targeting, view model, and drift sync #563, test: cover persistAndSyncSelectedAccount switching contract #564, test: cover runHealthCheck quick and live probe paths #565, test: cover forecast-report-shared patch persistence and save retry #566, test: cover the settings write queue retry and serialization contract #567, test: cover dashboard settings clone defaults and equality semantics #569, test: cover chooseAccount selection tiers and cursor discipline #570, test: cover ensureFreshAccessToken refresh, cooldown, and dedup paths #571, test: cover rotation proxy state init and stale-state recovery #572, test: cover the auth menu view-model formatting helpers #573 plus the later test: direct suite for the extracted account rate-limit helpers #580, test: direct suite for usage-ledger redaction and row normalization #582, test: direct suite for the settings preview builders #583, test: direct suite for settings-hub shared merge/persist helpers #584), the two fast-check property companions (test: property-check the unsupported-model fallback invariants #574, test: property-check write-queue serialization and clamp invariants #575), and eleven follow-ups from the same wave — the L3 convention doc (docs: document the class vs module-state convention (audit L3) #576), the beta.2 version-drift fix found by the baseline canary (fix: sync plugin manifest and docs portal to v2.3.0-beta.2 #577), the dead-code sweep that was closed and folded into the pre-existing refactor(lib): delete seven orphaned modules (852 dead lines) #554 (refactor: remove five orphaned modules (768 LOC of dead code) #578), the dedup-idempotence fix found by a new identity property suite (fix: deduplicateAccounts fixpoint loop and identity property tests #579), the unused-devDependency removal (chore: drop unused @fast-check/vitest devDependency #581), the closing batch of the §4.2 retry consolidation (refactor: migrate the last two hand-rolled retry loops to withRetry #585), the two §4.3 typed-error slices (refactor: throw CodexValidationError from rotation-proxy startup guards #586, refactor: abort unreadable config saves with a typed StorageError #587), the knowledge-base refreshes (docs: refresh test knowledge-base counts and list the new suites #588 for test/, docs: refresh the lib knowledge-base tree for the extraction era #589 for lib/), and the storage-suite spy-cascade isolation fix (test: stop leaked-spy cascades across the whole test runner #590).
• Updates M7's and M11's status cells in the §2 findings table now that §4.2 and §4.3 are fully executed.
• The prose notes why the numbering skips Decide whether to pin knip as a devDependency and wire it into CI #558 and IGNORE: testing MCP auth #562 (both are issues, not PRs) and docs: record the direct-coverage wave in the audit delivery log #568 (this delivery-log PR itself), and cites the two bugs the coverage method surfaced earlier in the cycle (fix(runtime): reject array helper-status files; dedupe isRecord #544 isRecord, fix(request): stream-stall failover, private-header prefix block, pinned-index message #546 stream-stall).

Validation

• npm run lint
• npm run typecheck
• npm test -- test/documentation.test.ts
• npm test / npm run build — not run for this markdown-only change; no code paths touched

Docs and Governance Checklist

• No user-visible behavior changed; audit-history doc only (additive snapshot note per docs/DOCUMENTATION.md audit policy)

Risk and Rollback

• Risk level: minimal — additive markdown in an audit history file; no code, tests, or config touched. Worst case is an adjacent-line merge conflict with the delivery-log edits on the still-open chore: add a tuned knip config and drop the unused @fast-check/vitest #555-line branches.
• Rollback plan: revert the commits on this branch (or delete §5.2); nothing depends on the section.

Additional Notes

• The new subsection is appended after the existing §5.1 table.

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

appends §5.2 to the 2026-06-10 audit delivery log, recording the direct-coverage wave (30 PRs: 17 direct test suites, 2 fast-check property companions, 11 follow-ups), and updates the M7/M11 findings-table status cells now that §4.2 and §4.3 are fully executed.

• the new prose explains the numbering gaps (Decide whether to pin knip as a devDependency and wire it into CI #558/IGNORE: testing MCP auth #562 are issues; docs: record the direct-coverage wave in the audit delivery log #568 is this pr itself) and cites the two cycle bugs the method already surfaced (fix(runtime): reject array helper-status files; dedupe isRecord #544 isRecord, fix(request): stream-stall failover, private-header prefix block, pinned-index message #546 stream-stall).
• the github pr description calls the table "twenty-nine rows" and lists "ten follow-ups," but the actual file has 30 rows and 11 follow-ups — test: stop leaked-spy cascades across the whole test runner #590 was added after the description was written; the markdown itself is self-consistent.

Confidence Score: 5/5

additive markdown snapshot in an audit history file — no code, tests, config, or logic touched; safe to merge.

the change is purely additive prose and a table in a docs-only file. the markdown is internally consistent: 30 rows in the table, #590 mentioned in both the prose list and its table row, M7/M11 status cells correctly reference the PRs that closed those findings. worst case is a minor merge conflict if adjacent delivery-log branches land before this.

no files require special attention

Important Files Changed

Filename	Overview
docs/audits/AUDIT_2026-06-10.md	adds §5.2 direct-coverage wave log (30-row table, M7/M11 status updates); document is internally self-consistent, no code touched

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["direct-coverage wave\n(§5.2)"] --> B["17 direct test suites\n#559–#573 + #580 + #582–#584"]
    A --> C["2 fast-check property suites\n#574 #575"]
    A --> D["11 follow-ups"]

    B --> B1["login / auth / health-check / persistence\nsuites mocking only effectful seams"]
    C --> C1["model-fallback + write-queue\ninvariant properties"]

    D --> D1["docs / conventions\n#576 L3 convention · #577 version-drift fix"]
    D --> D2["bug fixes\n#579 dedup idempotence · #585 §4.2 retry close\n#586 #587 §4.3 typed-error close"]
    D --> D3["cleanup\n#578 dead-code (closed→#554) · #581 devDep drop\n#588 #589 KB refresh · #590 spy-leak isolation"]

    D2 --> E["M7 status updated ✓"]
    D2 --> F["M11 status updated ✓"]

Loading

_{Reviews (21): Last reviewed commit: "docs: add the #590 spy-cascade isolation..." | Re-trigger Greptile}

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[coderabbitai]

📝 Walkthrough

Walkthrough

new audit subsection §5.2 added to docs/audits/AUDIT_2026-06-10.md describing divergent retry-with-backoff semantics (finding m7) and enumerating direct-coverage PRs and two non-test follow-ups.

Changes

Audit Coverage Documentation

Layer / File(s)	Summary
direct-coverage wave audit section docs/audits/AUDIT_2026-06-10.md	adds Medium finding M7 at docs/audits/AUDIT_2026-06-10.md:56 and inserts §5.2 at docs/audits/AUDIT_2026-06-10.md:180-228 listing direct-test PRs (#559–#575 and #576–#585 follow-ups) and notes the final retry consolidation in #585.

docs file updated only; no public API changes.

notes: missing regression tests for retry behavior consolidation are not present in test/... and should be added; watch for windows edge cases in sleep/timing semantics; concurrency/race risks in retry loops need explicit test coverage.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	title follows conventional commits format (docs: prefix, lowercase, imperative, 63 chars) and accurately summarizes the main change: recording the direct-coverage wave in the audit log.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description comprehensively covers summary, changes, validation, governance, risk, and rollback with clear markdown-only scope.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/audit-49-delivery-log

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/audit-49-delivery-log

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}