Summary

• Doc-only. Adds section 5.2 to docs/audits/AUDIT_2026-06-10.md recording the direct-coverage wave so the audit's delivery log stays the single record of what the roadmap produced.

What Changed

• New §5.2 narrative + thirty-row table: seventeen direct test suites (test: cover login-oauth account selection and cancellation predicates #559, test: cover login-menu manage actions and prompt fallbacks #560, test: cover runAuthLogin transports, org threading, and cap handling #561, test: cover login-menu data layer targeting, view model, and drift sync #563, test: cover persistAndSyncSelectedAccount switching contract #564, test: cover runHealthCheck quick and live probe paths #565, test: cover forecast-report-shared patch persistence and save retry #566, test: cover the settings write queue retry and serialization contract #567, test: cover dashboard settings clone defaults and equality semantics #569, test: cover chooseAccount selection tiers and cursor discipline #570, test: cover ensureFreshAccessToken refresh, cooldown, and dedup paths #571, test: cover rotation proxy state init and stale-state recovery #572, test: cover the auth menu view-model formatting helpers #573 plus the later test: direct suite for the extracted account rate-limit helpers #580, test: direct suite for usage-ledger redaction and row normalization #582, test: direct suite for the settings preview builders #583, test: direct suite for settings-hub shared merge/persist helpers #584), the two fast-check property companions (test: property-check the unsupported-model fallback invariants #574, test: property-check write-queue serialization and clamp invariants #575), and eleven follow-ups from the same wave — the L3 convention doc (docs: document the class vs module-state convention (audit L3) #576), the beta.2 version-drift fix found by the baseline canary (fix: sync plugin manifest and docs portal to v2.3.0-beta.2 #577), the dead-code sweep that was closed and folded into the pre-existing refactor(lib): delete seven orphaned modules (852 dead lines) #554 (refactor: remove five orphaned modules (768 LOC of dead code) #578), the dedup-idempotence fix found by a new identity property suite (fix: deduplicateAccounts fixpoint loop and identity property tests #579), the unused-devDependency removal (chore: drop unused @fast-check/vitest devDependency #581), the closing batch of the §4.2 retry consolidation (refactor: migrate the last two hand-rolled retry loops to withRetry #585), the two §4.3 typed-error slices (refactor: throw CodexValidationError from rotation-proxy startup guards #586, refactor: abort unreadable config saves with a typed StorageError #587), the knowledge-base refreshes (docs: refresh test knowledge-base counts and list the new suites #588 for test/, docs: refresh the lib knowledge-base tree for the extraction era #589 for lib/), and the storage-suite spy-cascade isolation fix (test: stop leaked-spy cascades across the whole test runner #590).
• Updates M7's and M11's status cells in the §2 findings table now that §4.2 and §4.3 are fully executed.
• The prose notes why the numbering skips Decide whether to pin knip as a devDependency and wire it into CI #558 and IGNORE: testing MCP auth #562 (both are issues, not PRs) and docs: record the direct-coverage wave in the audit delivery log #568 (this delivery-log PR itself), and cites the two bugs the coverage method surfaced earlier in the cycle (fix(runtime): reject array helper-status files; dedupe isRecord #544 isRecord, fix(request): stream-stall failover, private-header prefix block, pinned-index message #546 stream-stall).

Validation

• npm run lint
• npm run typecheck
• npm test -- test/documentation.test.ts
• npm test / npm run build — not run for this markdown-only change; no code paths touched

Docs and Governance Checklist

• No user-visible behavior changed; audit-history doc only (additive snapshot note per docs/DOCUMENTATION.md audit policy)

Risk and Rollback

• Risk level: minimal — additive markdown in an audit history file; no code, tests, or config touched. Worst case is an adjacent-line merge conflict with the delivery-log edits on the still-open chore: add a tuned knip config and drop the unused @fast-check/vitest #555-line branches.
• Rollback plan: revert the commits on this branch (or delete §5.2); nothing depends on the section.

Additional Notes

• The new subsection is appended after the existing §5.1 table.

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

appends §5.2 to the 2026-06-10 audit delivery log, recording the direct-coverage wave (30 PRs: 17 direct test suites, 2 fast-check property companions, 11 follow-ups), and updates the M7/M11 findings-table status cells now that §4.2 and §4.3 are fully executed.

• the new prose explains the numbering gaps (Decide whether to pin knip as a devDependency and wire it into CI #558/IGNORE: testing MCP auth #562 are issues; docs: record the direct-coverage wave in the audit delivery log #568 is this pr itself) and cites the two cycle bugs the method already surfaced (fix(runtime): reject array helper-status files; dedupe isRecord #544 isRecord, fix(request): stream-stall failover, private-header prefix block, pinned-index message #546 stream-stall).
• the github pr description calls the table "twenty-nine rows" and lists "ten follow-ups," but the actual file has 30 rows and 11 follow-ups — test: stop leaked-spy cascades across the whole test runner #590 was added after the description was written; the markdown itself is self-consistent.

Confidence Score: 5/5

additive markdown snapshot in an audit history file — no code, tests, config, or logic touched; safe to merge.

the change is purely additive prose and a table in a docs-only file. the markdown is internally consistent: 30 rows in the table, #590 mentioned in both the prose list and its table row, M7/M11 status cells correctly reference the PRs that closed those findings. worst case is a minor merge conflict if adjacent delivery-log branches land before this.

no files require special attention

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["direct-coverage wave\n(§5.2)"] --> B["17 direct test suites\n#559–#573 + #580 + #582–#584"]
    A --> C["2 fast-check property suites\n#574 #575"]
    A --> D["11 follow-ups"]

    B --> B1["login / auth / health-check / persistence\nsuites mocking only effectful seams"]
    C --> C1["model-fallback + write-queue\ninvariant properties"]

    D --> D1["docs / conventions\n#576 L3 convention · #577 version-drift fix"]
    D --> D2["bug fixes\n#579 dedup idempotence · #585 §4.2 retry close\n#586 #587 §4.3 typed-error close"]
    D --> D3["cleanup\n#578 dead-code (closed→#554) · #581 devDep drop\n#588 #589 KB refresh · #590 spy-leak isolation"]

    D2 --> E["M7 status updated ✓"]
    D2 --> F["M11 status updated ✓"]

_{Reviews (21): Last reviewed commit: "docs: add the #590 spy-cascade isolation..." | Re-trigger Greptile}