Add an implementation plan to address the audit findings

docs/roadmap/audit-remediation.md

@@ -1,603 +0,0 @@
-# Repository Audit Remediation Roadmap
-
-Status: Ready for implementation.
-
-## Purpose And Authority
-
-This roadmap translates the confirmed findings in the
-[repository audit ledger](audit.md) into dependency-ordered implementation
-stages. The ledger owns discovery evidence and final finding disposition. This
-document owns remediation scope, ordering, locked behavior, verification, and
-completion state until the work is finished.
-
-All 74 confirmed findings are accepted for remediation. None is priority-
-deferred and none requires a separate product or architecture decision before
-work can begin. Four rejected standalone findings remain consolidated into
-their confirmed owners and are not separate work items.
-
-This roadmap describes future work. Until an individual stage is implemented,
-canonical current-state documentation and executable behavior remain
-authoritative.
-
-## Implementation Rules
-
-Every stage must:
-
-- read `docs/development.md`, all files under `docs/policy/`, this roadmap, and
-  the task-specific canonical documents identified below;
-- implement only its listed findings and prerequisites;
-- preserve the architecture policy's stateless pipeline, adapter boundaries,
-  curated prompt boundary, operator-owned outputs, comparison ordering, and
-  notification rules unless the stage explicitly corrects that contract;
-- add durable tests at the narrowest stable boundary and avoid duplicating
-  behavior already owned elsewhere;
-- update every listed canonical documentation owner in the same change as an
-  implemented contract change;
-- use deterministic, offline, credential-free tests and synthetic fixtures;
-- run `gofmt` on changed Go files, the stage's focused commands,
-  `GOWORK=off go test -count=1 ./...`, and `git diff --check`; and
-- commit the completed stage separately when the implementing prompt requests
-  commits.
-
-Stages affecting concurrent execution, cancellation, filesystem mutation, or
-process-global state must also run the affected packages with `-race`. No stage
-may weaken a safety invariant merely to make a test pass.
-
-## Priority And Finding Allocation
-
-Each confirmed finding appears exactly once below. Priority describes
-remediation order, not confidence; every listed finding has high confidence.
-
-| Priority | Stages | Findings | Decision |
-| --- | --- | --- | --- |
-| P0: generated forecast integrity | 1 | `AUD-029`, `AUD-030`, `AUD-031`, `AUD-033` | Accepted now |
-| P1: security, correctness, and data integrity | 2-22 | `AUD-002` through `AUD-021` excluding rejected `AUD-022`; `AUD-023` through `AUD-028`; `AUD-034` through `AUD-038`; `AUD-040` through `AUD-058`; `AUD-073`, `AUD-074`, `AUD-077`, and `AUD-078` | Accepted now |
-| P2: deterministic test and operational quality | 23-27 | `AUD-059` through `AUD-062`, `AUD-064`, `AUD-065`, and `AUD-066` | Accepted now |
-| P3: behavior-preserving consolidation and cleanup | 28-32 | `AUD-039`, `AUD-067` through `AUD-072` | Accepted now |
-| P4: documentation lifecycle and audit retirement | 33-35 | `AUD-075` and `AUD-076`; final audit-record retirement | Accepted now |
-
-Rejected `AUD-001`, `AUD-022`, and `AUD-032` are represented only through
-`AUD-072`; rejected `AUD-063` is represented only through `AUD-039`.
-
-## Remediation Stages
-
-### Stage 1: Correct The Curated Prompt Package Contract
-
-- Findings: `AUD-029`, `AUD-030`, `AUD-031`, `AUD-033`.
-- Affected areas: `internal/promptinput`, shared embedded prompt assets, and
-  focused prompt-input/prompt-asset tests.
-- Work: remove raw transport-shaped warning details from provider input; make
-  shared prompt paths match serialized YAML; describe regional versus point-
-  matched hazard products accurately; and cover stanza serialization failure.
-- Locked behavior: deterministic category/stanza order, exact prompt identity,
-  safe normal diagnostics, and byte-stable valid YAML remain unchanged.
-- Documentation owners: `docs/internal/prompt-input.md` and
-  `docs/integrations/promptkit.md` if their implemented contract changes.
-- Exit commands: focused tests for `./internal/promptinput` and
-  `./internal/promptassets`, then the standard repository commands.
-
-### Stage 2: Make Configuration Validation Atomic And Explicit
-
-- Findings: `AUD-004`, `AUD-006`, `AUD-007`, `AUD-078`.
-- Affected areas: `internal/config`, report-key lookup, timezone parsing,
-  maintained examples, and configuration tests.
-- Work: reject unsupported missing-source keys; make programmatic report
-  overrides obey the same presence semantics as loaded configuration; apply
-  secrets only after the complete load succeeds; and document accepted report-
-  key normalization and numeric-offset bounds.
-- Locked behavior: file/CLI precedence, inactive-integration policy, exact
-  command-name lookup, and secret redaction remain unchanged.
-- Documentation owners: `docs/config.md` and maintained examples only where
-  executable behavior requires them.
-- Exit commands: `GOWORK=off go test -race -count=1 ./internal/config
-  ./internal/cli`, followed by the standard repository commands.
-
-### Stage 3: Require Complete Single-Report Notification Identity
-
-- Findings: `AUD-005`.
-- Affected areas: Distributor notification configuration, bundle-ID rendering,
-  and focused config/app tests.
-- Work: reject enabled single-report notification configurations that can
-  produce blank required identity fields before report work begins.
-- Locked behavior: inactive notification settings remain optional; configured
-  templates and publication-before-notification ordering remain intact.
-- Documentation owners: `docs/config.md`, `docs/operations.md`, and Distributor
-  integration docs if accepted values or failures change.
-- Exit commands: focused config and app notification tests, then the standard
-  repository commands.
-
-### Stage 4: Correct CLI Cancellation, Preflight, And Visible Contracts
-
-- Findings: `AUD-008`, `AUD-009`, `AUD-010`, `AUD-074`.
-- Affected areas: `cmd/weatherreporter`, `internal/cli`, assembled CLI tests,
-  help text, and CLI documentation.
-- Work: propagate process interrupts through action contexts; validate report
-  dates before executor construction; add representative generate and batch
-  result/exit tests; and align help/internal guidance with quiet, date, and
-  comparison behavior.
-- Locked behavior: command/flag ownership, structured summary shapes, stream
-  separation, and one executor per action remain unchanged.
-- Documentation owners: `docs/cli.md` and `docs/internal/cli.md`.
-- Exit commands: `GOWORK=off go test -race -count=1 ./internal/cli
-  ./internal/app ./cmd/weatherreporter`, both root and comparison help commands,
-  then the standard repository commands.
-
-### Stage 5: Harden The Weather API Transport Boundary
-
-- Findings: `AUD-011`, `AUD-012`, `AUD-013`, `AUD-014`, `AUD-015`.
-- Affected areas: Weather API configuration/adapter, normalized hourly data,
-  local HTTP fixtures, and collection tests.
-- Work: accept only supported endpoint forms; bound and redact non-success
-  diagnostics; reject rather than truncate oversized bodies; require usable
-  hourly time bounds; and retry warmup only for transient failures.
-- Locked behavior: all eight source contracts, checked-empty optional products,
-  cancellation, provenance, and offline testing remain intact.
-- Documentation owners: `docs/config.md`,
-  `docs/integrations/weatherapi.md`, `docs/internal/weather-data.md`, and
-  `docs/internal/collect.md` as applicable.
-- Exit commands: focused adapter/collection tests including boundary-size and
-  cancellation cases, then the standard repository commands.
-
-### Stage 6: Correct Civil-Time And Forecast Derivation Boundaries
-
-- Findings: `AUD-002`, `AUD-003`, `AUD-016`, `AUD-017`, `AUD-018`, `AUD-019`.
-- Affected areas: `internal/timeutil`, `internal/report`, `internal/forecast`,
-  `internal/facts`, and their focused tests.
-- Work: construct configured clocks as local civil times across DST; protect
-  Daily run-ID uniqueness; preserve units in fallback values; include the full
-  overnight alert interval; reject invalid precipitation percentages; and
-  classify ordinary icy wording consistently.
-- Locked behavior: half-open selection, chronological ordering, rolling Hourly
-  elapsed time, and source-period identity remain unchanged.
-- Documentation owners: `docs/internal/report-registry.md`,
-  `docs/internal/forecast-derivation.md`, and `docs/internal/facts.md`.
-- Exit commands: focused time/report/forecast/facts tests with both DST
-  transitions and metric cases, then the standard repository commands.
-
-### Stage 7: Correct Source-Facing Briefing Module Semantics
-
-- Findings: `AUD-020`, `AUD-021`.
-- Affected areas: briefing module option validation, weather-story construction,
-  module registry tests, and normalized source fixtures.
-- Work: make accepted AFD option shapes constructible and omit semantically
-  empty weather stories instead of publishing false availability.
-- Locked behavior: report support, default compositions, checked-empty alerts,
-  and ordered module snapshots remain unchanged.
-- Documentation owners: `docs/internal/module.md` and
-  `docs/internal/briefing.md`.
-- Exit commands: focused briefing/module tests, then the standard repository
-  commands.
-
-### Stage 8: Correct Derived Briefing Language And Ranking
-
-- Findings: `AUD-023`, `AUD-026`, `AUD-027`.
-- Affected areas: derived daily summaries, outdoor-window scoring, temperature
-  band wording, and briefing tests.
-- Work: label apparent temperature accurately; include snow, ice, and fog in
-  outdoor-window ranking; and preserve negative-zero temperature meaning.
-- Locked behavior: deterministic ranking, Today-only planning scope, and
-  existing module/schema identities remain unchanged.
-- Documentation owners: `docs/internal/briefing.md` and prompt-facing field
-  documentation if names or meaning change.
-- Exit commands: focused briefing tests with metric, subzero, and hazard cases,
-  then the standard repository commands.
-
-### Stage 9: Establish One Daypart Canonicalization Mechanism
-
-- Findings: `AUD-067`.
-- Affected areas: duplicated canonical-key helpers in briefing and
-  generated-text packages plus their behavior tests.
-- Work: establish one domain-owned canonical key contract and route both
-  current consumers through it without changing accepted ASCII behavior.
-- Locked behavior: display labels, report-specific semantic roles, ordering,
-  and current valid output remain unchanged.
-- Documentation owners: focused internal briefing/generated-text docs only if
-  ownership needs explanation.
-- Exit commands: focused briefing and generated-text tests, then the standard
-  repository commands.
-
-### Stage 10: Correct Daypart Identity, Collision, And Display Behavior
-
-- Findings: `AUD-024`, `AUD-025`, `AUD-073`.
-- Affected areas: derived daypart summaries, planning builders, display
-  capitalization, configuration fixtures, and rendering tests.
-- Work: reject canonical-key collisions; use configured identities consistently
-  across planning; and make non-ASCII display capitalization rune-safe.
-- Locked behavior: Stage 9's canonical identity remains separate from display
-  text; stable ordering and default dayparts remain unchanged.
-- Documentation owners: `docs/config.md`, `docs/internal/briefing.md`, and
-  generated-text/template docs if visible labels change.
-- Exit commands: focused config/briefing/generated-text/reporttemplate tests,
-  then the standard repository commands.
-
-### Stage 11: Refresh The Official SPC Definition Asset
-
-- Findings: `AUD-028`.
-- Affected areas: embedded SPC category definitions, source attribution, and
-  risk-digest tests.
-- Work: reconcile descriptions with the current authoritative SPC table and
-  record a durable source/review mechanism without changing risk thresholds
-  accidentally.
-- Locked behavior: deterministic category ordering, threshold selection, and
-  overlap logic remain unchanged unless current official semantics require an
-  explicit reviewed correction.
-- Documentation owners: `docs/internal/briefing.md` or another single
-  canonical maintainer owner for the external definition source.
-- Exit commands: focused briefing asset/risk tests, then the standard
-  repository commands.
-
-### Stage 12: Secure Prompt-Debug Redaction And Filesystem Traversal
-
-- Findings: `AUD-034`, `AUD-035`.
-- Affected areas: `internal/promptdebug`, Promptkit debug callbacks, endpoint
-  redaction, filesystem operations, and adversarial tests.
-- Work: redact common credential aliases and URL credential forms; replace
-  pathname check/use gaps with a race-resistant secure creation strategy.
-- Locked behavior: debug remains explicit opt-in with `0700` directories,
-  `0600` files, deterministic references, and no sensitive normal output.
-- Documentation owners: `docs/operations.md` and
-  `docs/integrations/promptkit.md`.
-- Exit commands: focused promptdebug/Promptkit tests plus
-  `GOWORK=off go test -race -count=1 ./internal/promptdebug
-  ./internal/adapters/promptkit ./internal/app`, then standard commands.
-
-### Stage 13: Enforce Generated-Text Identity, Shape, And Size
-
-- Findings: `AUD-036`, `AUD-037`, `AUD-038`.
-- Affected areas: generated-text catalog, decoders, schemas, typed validators,
-  Promptkit result handling, and focused tests.
-- Work: require report-specific schema/template pairs; reject case-variant
-  properties that schemas reject; and bound prose, arrays, and diagnostic
-  context before allocation or normal error projection.
-- Locked behavior: typed normalization, exact registered identities, schema
-  copy isolation, and valid generated content remain unchanged.
-- Documentation owners: `docs/internal/generatedtext.md`, template docs, and
-  Promptkit integration limits where externally relevant.
-- Exit commands: focused generated-text/promptassets/app tests including limit
-  boundaries, then the standard repository commands.
-
-### Stage 14: Establish One Prepared Metadata Authority
-
-- Findings: `AUD-069`.
-- Affected areas: briefing metadata construction, prepared reports, prompt
-  metadata projection, render-context inputs, and focused app/briefing tests.
-- Work: establish one prepared identity/timing source and narrow projections
-  without changing serialized YAML or rendered Markdown.
-- Locked behavior: prompt and output bytes for valid fixtures, immutable
-  prepared inputs, and module ordering remain unchanged.
-- Documentation owners: `docs/internal/prepared-report.md`,
-  `docs/internal/briefing.md`, and `docs/internal/prompt-input.md`.
-- Exit commands: focused briefing/app/promptinput/generatedtext tests, then the
-  standard repository commands.
-
-### Stage 15: Enforce Render Identity And Markdown Structure
-
-- Findings: `AUD-040`, `AUD-041`, `AUD-042`.
-- Affected areas: render-context builders, repository templates/partials,
-  generated prose insertion, and rendering tests.
-- Work: reject conflicting report identities; prevent dynamic prose from
-  impersonating deterministic Markdown structure; and suppress or replace an
-  empty Today daypart section.
-- Locked behavior: repository templates remain Markdown owners, deterministic
-  facts remain authoritative, and normal section order remains unchanged.
-- Documentation owners: `docs/templates.md`,
-  `docs/internal/generatedtext.md`, and `docs/internal/reporttemplate.md`.
-- Exit commands: focused generated-text/reporttemplate/app tests including
-  adversarial heading content, then the standard repository commands.
-
-### Stage 16: Move Prompt Compatibility And Provenance Checks Before Work
-
-- Findings: `AUD-043`, `AUD-044`.
-- Affected areas: application prompt inspection/preparation/execution,
-  generated-text catalog preflight, provenance values, and app tests.
-- Work: validate catalog compatibility before collection and reconcile
-  inspected, prepared, callback, completed, and schema identities before
-  accepting generated output.
-- Locked behavior: one inspection/preparation, profile precedence, immutable
-  execution copies, and partial execution result ownership remain unchanged.
-- Documentation owners: `docs/internal/prepared-report.md`,
-  `docs/internal/app-orchestration.md`, and Promptkit integration docs.
-- Exit commands: focused app/promptexec/generatedtext tests, then the standard
-  repository commands.
-
-### Stage 17: Make Single-Report Publication Type-Safe And Cancelable
-
-- Findings: `AUD-045`, `AUD-046`, `AUD-047`.
-- Affected areas: `internal/fileutil`, app output planning/publication,
-  destination error projection, and filesystem tests.
-- Work: reject non-regular final destinations; use bounded temporary naming
-  without leaving new directories on precommit failure; and check cancellation
-  at the rename linearization point.
-- Locked behavior: same-directory atomic visibility, preservation of prior
-  regular files, restrictive new-file mode, truthful committed paths, and
-  notification-after-publication remain unchanged.
-- Documentation owners: `docs/operations.md`, architecture policy if an
-  invariant needs clarification, and app orchestration internals.
-- Exit commands: focused fileutil/app/CLI filesystem tests plus
-  `GOWORK=off go test -race -count=1 ./internal/fileutil ./internal/app
-  ./internal/cli`, then standard commands.
-
-### Stage 18: Bound And Validate The Distributor Adapter Boundary
-
-- Findings: `AUD-048`, `AUD-049`, `AUD-050`, `AUD-052`.
-- Affected areas: Distributor config validation, repository adapter, pinned
-  client interaction, local HTTP tests, and safe batch diagnostics.
-- Work: reject unsupported endpoints before publication; bound response reads;
-  redact or classify remote text before normal results; and exercise the real
-  production HTTP boundary with a local server.
-- Locked behavior: exactly-once upload/status mapping, published-file source
-  selection, token redaction, and dependency types remaining adapter-local.
-- Documentation owners: `docs/config.md`, `docs/operations.md`,
-  `docs/internal/distributor-adapter.md`, and Distributor integration docs.
-- Exit commands: focused config/distributor/app tests including oversized and
-  malicious response bodies, then the standard repository commands.
-
-### Stage 19: Preserve Batch Cancellation As A Distinct Outcome
-
-- Findings: `AUD-051`.
-- Affected areas: batch orchestration, result/error types, CLI projection, and
-  cancellation tests.
-- Work: stop starting later reports after cancellation and preserve
-  cancellation separately from independent report failures and notification
-  state.
-- Locked behavior: collect once, deterministic planned order, continuation
-  after non-cancellation failures, report-only counters, and all-success
-  notification gating remain unchanged.
-- Documentation owners: `docs/cli.md`, `docs/operations.md`, and
-  `docs/internal/app-orchestration.md`.
-- Exit commands: focused app/CLI tests plus
-  `GOWORK=off go test -race -count=1 ./internal/app ./internal/cli`, then
-  standard commands.
-
-### Stage 20: Tighten Comparison Manifest Compatibility
-
-- Findings: `AUD-053`, `AUD-054`.
-- Affected areas: comparison JSON decoding, manifest/logical-bundle validation,
-  filename helpers, and compatibility tests.
-- Work: reject duplicate and case-variant fields and require each successful
-  report path to equal the canonical ordinal/profile filename.
-- Locked behavior: current schema version, deterministic encoding/hashing,
-  flat exact file set, ordered profiles, and bounded recognition errors remain.
-- Documentation owners: `docs/integrations/comparison-bundle.md` and
-  `docs/internal/comparison-publication.md`.
-- Exit commands: focused comparison compatibility tests, then the standard
-  repository commands.
-
-### Stage 21: Make Comparison Replacement Cancellation And Recovery Truthful
-
-- Findings: `AUD-055`, `AUD-056`, `AUD-057`.
-- Affected areas: comparison planning/publication, backup cleanup/result state,
-  sibling naming, app/CLI recovery projection, and filesystem tests.
-- Work: honor cancellation before replacement commit; distinguish a complete
-  retained recovery bundle from a partially removed backup; and fail long-name
-  constraints during preflight without residual directories.
-- Locked behavior: post-move authorization, rollback, no forced destructive
-  cleanup, committed-new-bundle truth, and actionable recovery paths remain.
-- Documentation owners: comparison bundle/publication docs, operations, and
-  CLI result docs where state representation changes.
-- Exit commands: focused comparison/app/CLI tests plus
-  `GOWORK=off go test -race -count=1 ./internal/comparison ./internal/app
-  ./internal/cli`, then standard commands.
-
-### Stage 22: State Executor Concurrency And Preserve Profile Failures
-
-- Findings: `AUD-058`, `AUD-077`.
-- Affected areas: `promptexec.Executor` contract, comparison execution/result
-  aggregation, Promptkit adapter, app fakes, and CLI tests.
-- Work: document and test concurrent-call substitutability and preserve
-  already-completed profile failures when later command cancellation occurs.
-- Locked behavior: one shared executor, one goroutine per explicit profile,
-  provider-owned capacity, joined workers, selection ordering, and no
-  Distributor notification remain unchanged.
-- Documentation owners: Promptkit integration and comparison execution/app
-  orchestration internals.
-- Exit commands: focused promptexec/Promptkit/app/CLI tests plus
-  `GOWORK=off go test -race -count=1 ./internal/adapters/promptkit
-  ./internal/app ./internal/cli`, then standard commands.
-
-### Stage 23: Make Tests Independent Of Ambient Host State
-
-- Findings: `AUD-059`, `AUD-060`.
-- Affected areas: Promptkit credential tests and symlink tests in app,
-  promptdebug, and comparison packages.
-- Work: explicitly control the credential environment and treat inability to
-  create symlinks as a tested capability prerequisite rather than product
-  failure.
-- Locked behavior: real supported-host symlink safety assertions and missing-
-  credential behavior remain fully protected.
-- Documentation owners: testing policy only if supported-platform policy is
-  deliberately changed; normally none.
-- Exit commands: focused packages under scrubbed and ordinary environments,
-  race-enabled focused tests, then standard commands.
-
-### Stage 24: Remove Redundant Assertions And Production Test Waits
-
-- Findings: `AUD-061`, `AUD-062`.
-- Affected areas: briefing SPC tests, collection wrapper tests, Distributor
-  polling tests, and narrow timing seams.
-- Work: remove the private-constant assertion while retaining observable risk
-  behavior; inject only the wait controls necessary to avoid production delays
-  in deterministic tests.
-- Locked behavior: production retry/poll intervals and observable SPC policy
-  remain unchanged.
-- Documentation owners: none unless a contributor-facing test seam warrants a
-  focused internal note.
-- Exit commands: focused briefing/collect/distributor tests with repeated runs,
-  then the standard repository commands.
-
-### Stage 25: Make Comparison Test Failure Cleanup Total
-
-- Findings: `AUD-064`.
-- Affected areas: comparison execution test barriers and worker cleanup in
-  `internal/app` tests.
-- Work: release and join workers on timeout, early completion, duplicate start,
-  and every diagnostic exit without weakening liveness detection.
-- Locked behavior: production comparison scheduling and five-second deadlock
-  diagnostics remain unchanged.
-- Documentation owners: none.
-- Exit commands: repeat focused comparison-execution tests and run them with
-  `-race`, then the standard repository commands.
-
-### Stage 26: Remove Redundant Weather Fetches And Safe Serialization
-
-- Findings: `AUD-065`.
-- Affected areas: Weather API bundle acquisition, request-result aggregation,
-  provenance ordering, cancellation, and adapter/collection tests.
-- Work: reuse or remove the discarded warmup current response and execute
-  independent source requests concurrently through one deterministic merge.
-- Locked behavior: source-local validation/errors, exact source order,
-  required/optional policy, retry policy after Stage 5, and context cancellation
-  remain authoritative.
-- Documentation owners: Weather API integration and collection internals if
-  operational request behavior changes materially.
-- Exit commands: focused latency/request-count and cancellation tests plus
-  `GOWORK=off go test -race -count=1 ./internal/adapters/weatherapi
-  ./internal/collect`, then standard commands.
-
-### Stage 27: Eliminate Repeated Comparison Bundle Reads
-
-- Findings: `AUD-066`.
-- Affected areas: comparison recognition/planning/publication and app
-  comparison preflight.
-- Work: pass or cache only the recognition evidence needed to avoid four full
-  reads while retaining reauthorization at every mutation boundary.
-- Locked behavior: early rejection, exact file/type validation, post-move
-  authorization, deterministic hashes, and concurrent destination safety after
-  Stage 21 remain unchanged.
-- Documentation owners: comparison publication internals if ownership or
-  transaction phases change.
-- Exit commands: focused read-count and adversarial replacement tests plus
-  `GOWORK=off go test -race -count=1 ./internal/comparison ./internal/app`, then
-  standard commands.
-
-### Stage 28: Consolidate Distributor Template Parsing
-
-- Findings: `AUD-068`.
-- Affected areas: single and batch notification template rendering and config
-  tests.
-- Work: extract one private grammar/parser with typed callbacks while
-  preserving each template family's variable allowlist and error context.
-- Locked behavior: accepted syntax, rejected malformed forms, exact rendering,
-  and single-versus-batch policy remain unchanged.
-- Documentation owners: none unless the user-visible grammar changes, which is
-  outside this behavior-preserving stage.
-- Exit commands: focused config tests, then the standard repository commands.
-
-### Stage 29: Centralize Fact Requirement Policy
-
-- Findings: `AUD-070`.
-- Affected areas: module requirement vocabulary, briefing definitions,
-  availability checks, constructor validation, and tests.
-- Work: define requirement identity/category/predicate once while leaving each
-  module's requirement list and missing-data policy explicit.
-- Locked behavior: all current compositions, supported reports, availability,
-  and diagnostic identity remain byte-for-byte or semantically unchanged.
-- Documentation owners: module and briefing internals if ownership changes.
-- Exit commands: focused module/briefing/config tests, then the standard
-  repository commands.
-
-### Stage 30: Consolidate CLI Report-Date Policy
-
-- Findings: `AUD-071`.
-- Affected areas: generate/comparison flag registration and date resolution,
-  CLI parser/action tests, and private CLI descriptors.
-- Work: establish one private report-date policy/resolver used by both actions
-  after Stage 4 has locked corrected behavior.
-- Locked behavior: accepted flags, required/default dates, action-specific
-  errors, and request types remain unchanged.
-- Documentation owners: none unless implementation reveals a current contract
-  mismatch; CLI docs remain authoritative.
-- Exit commands: focused CLI parser/action tests and help commands, then the
-  standard repository commands.
-
-### Stage 31: Retire Dormant Compatibility And Persistence Surfaces
-
-- Findings: `AUD-072`.
-- Affected areas: unused prompt YAML loading/saving, Weather API bundle saving,
-  JSON atomic helper if orphaned, module snapshot compatibility implication,
-  forecast threshold exports, full alert envelope copies, normalized generated
-  JSON returns, and sole-purpose tests/docs.
-- Work: remove the no-owner surfaces identified by the audit. If an actual
-  production consumer appears before implementation, stop this stage and
-  replace the retirement with a separately approved narrow contract; do not
-  retain speculative compatibility.
-- Locked behavior: normal Build/Validate/MarshalYAML, report publication,
-  comparison bundles, prompt debugging, alert item provenance, real forecast
-  decisions, typed normalization, and all workflows remain unchanged.
-- Documentation owners: affected focused internal documents; remove stale
-  descriptions rather than documenting retired APIs.
-- Exit commands: graph/text caller checks showing no remaining references,
-  focused affected package tests, then the standard repository commands.
-
-### Stage 32: Consolidate Generated-Text Test Ownership
-
-- Findings: `AUD-039`.
-- Affected areas: generated-text day-style and render-context tests,
-  promptassets schema tests, and reporttemplate tests.
-- Work: keep one shared semantic suite plus thin report-identity cases; put
-  schema ownership in promptassets and Markdown ownership in reporttemplate;
-  retain one real typed-context render integration.
-- Locked behavior: every public validator identity, distinct Hourly behavior,
-  schema/type agreement, typed projection, template semantics, and composition
-  remain protected.
-- Documentation owners: none.
-- Exit commands: focused promptassets/generatedtext/reporttemplate tests, then
-  the standard repository commands.
-
-### Stage 33: Reconcile Stale Internal Implementation Guides
-
-- Findings: `AUD-075`.
-- Affected areas: forecast derivation, collection, report registry, and prompt-
-  input internal guides plus incoming links.
-- Work: replace nonexistent API/flow/test claims with concise descriptions of
-  the implemented owners and link to canonical contracts instead of duplicating
-  volatile details.
-- Locked behavior: documentation-only; no executable contract changes.
-- Documentation owners: the four affected `docs/internal/` files and
-  `docs/development.md` only if task routing changes.
-- Exit commands: repository link/fence checks, focused test inventories used to
-  verify claims, `GOWORK=off go test -count=1 ./...`, and `git diff --check`.
-
-### Stage 34: Retire Completed Comparison Roadmaps
-
-- Findings: `AUD-076`.
-- Affected areas: `docs/roadmap/profile-comparison.md`,
-  `docs/roadmap/implementation.md`, and all incoming links.
-- Work: verify useful implemented contracts have one durable canonical owner,
-  repair incoming navigation, then remove the completed roadmaps so they no
-  longer duplicate current behavior.
-- Locked behavior: documentation lifecycle only; no code, tests, dependencies,
-  schemas, or current contracts change.
-- Documentation owners: CLI, operations, comparison integration/publication,
-  comparison execution, Promptkit integration, architecture, and development
-  docs only where an incoming link or missing durable fact requires correction.
-- Exit commands: repository link/fence checks, both CLI help commands,
-  `GOWORK=off go test -count=1 ./...`, and `git diff --check`.
-
-### Stage 35: Close Remediation And Retire Audit Records
-
-- Findings: none; this is the roadmap lifecycle gate.
-- Prerequisite: Stages 1-34 are complete and every referenced finding's tests
-  and canonical documentation have landed.
-- Affected areas: `docs/roadmap/audit.md`, `audit-plan.md`, this roadmap, and
-  incoming links.
-- Work: verify every finding is resolved, superseded, or explicitly moved to a
-  newly approved roadmap; move any durable rationale to its canonical owner;
-  verify no active work or incoming link depends on these coordination files;
-  then remove the temporary audit plan, ledger, and this roadmap in the final
-  lifecycle change.
-- Locked behavior: documentation lifecycle only; do not rewrite historical
-  ADRs or release notes and do not create a second current-state reference.
-- Documentation owners: all durable owners touched by earlier stages, solely
-  to fill a demonstrated ownership gap.
-- Exit commands: repository link/fence and secret-pattern checks; all focused
-  stage exits; `GOWORK=off go test -count=1 ./...`,
-  `GOWORK=off go test -race -count=1 ./...`, both CLI help commands,
-  `GOWORK=off go vet ./...`, and `git diff --check`.
-
-## Completion Tracking
-
-Update a stage heading or add a concise completion note only after its code,
-tests, canonical documentation, and exit commands pass together. Do not copy
-implemented contracts into this roadmap. When all work is complete, follow
-Stage 35 rather than retaining this file as a parallel reference.

docs/roadmap/audit.md

@@ -280,7 +280,7 @@ evidence and the architecture's stated boundaries.
 | P3 | `AUD-039`, `AUD-067` through `AUD-072` | Behavior-preserving consolidation and dormant-surface retirement accepted after the behavior they touch is corrected and locked by tests. |
 | P4 | `AUD-075`, `AUD-076`, and audit-record retirement | Documentation lifecycle work accepted last, after implemented contracts have durable canonical owners. |
 
-The remediation roadmap's allocation table and 35 stages are the authoritative
+The remediation roadmap's allocation table and 56 stages are the authoritative
 finding-to-stage mapping. All 74 confirmed findings are accepted now; none is
 deferred and none requires a prerequisite decision. Rejected `AUD-001`,
 `AUD-022`, and `AUD-032` flow only through `AUD-072`; rejected `AUD-063` flows
@@ -6210,7 +6210,7 @@ directly established.
 - Accepted all 74 confirmed findings for implementation. None was priority-
   deferred, and the evidence was sufficient to choose a corrective direction
   without a separate product or architecture decision.
-- Created `docs/roadmap/audit-remediation.md` with 35 independently executable
+- Created `docs/roadmap/audit-remediation.md` with 56 independently executable
   stages. Each stage names its findings, affected areas, work, locked behavior,
   test expectations, canonical documentation owners, and exit commands.
 - Allocated every confirmed finding exactly once. Correctness, security, data