docs(todo): TRIM close-out audit — CONCERNS, 5 veto findings closed

[keithdv]

Runs the whole-arc close-out audit (Step 7) for the TRIM todo and closes every veto-tier finding. Documentation and container only — no generator behaviour changes, and no source change beyond one corrected comment.

Verdict: CONCERNS — 5 veto-tier, 10 callout-tier. Every checkable finding was independently re-derived at the keyboard before being accepted; all held. Record: reviews/closeout-audit.md.

The finding that mattered most

V2 — the AC6 carve-out was dishonest in the one place a generator editor reads first.

InterfaceFactoryRenderer.cs:260 still asserted "the trimmer removes the entire body" — precisely the claim TRIM-009's H1 measured insufficient for async. That leg emits its guard inline (zero Core methods in its emitted output) and still names {ImplName}Factory in its registrar attribute, so it keeps the exact shape TRIM-009 proved leaks.

todo.md claimed the retraction had landed in "all three" places. It had landed in five and missed this sixth — the only one inside the generator.

This is the fifth occurrence in this arc of building a doc list from an inventory instead of grepping the artifacts. It is now recorded as a pattern rather than a one-off, because restating the lesson has demonstrably not fixed it.

Other veto-tier findings

• V1 — two integration tests failed. The auditor was explicitly asked to challenge the "known flake" label rather than take my word, and did real work: traced the relay path to a git log stopping at v1.4.0 (before the arc began), identified the Task.Run/Task.Yield mechanism against a 2s poll deadline, noted both failures burned exactly [2 s], and observed two concurrent TFM hosts running while MSBuild still compiled the Blazor WASM examples. Closed by re-run: 561+561, 0 failed, both TFMs. The arc does not close on an unexplained red.
• V3 — AC4's release step had no enumerated obligations. Nine artifacts describe v1.7.0 behaviour while the package is 1.6.1, two of them in undated present tense on the published Jekyll site — so a current consumer is told their [Execute] bodies are protected by a holder that ships in no installable version. The container tracked the inverse exposure (docs behind code) exhaustively and this one not at all. Also: TRIM-009's synchronous-throw behaviour change lives only in a Done plan's prose, under a fix:-prefixed commit that CLAUDE.md's commit-scanning release process would render as a patch bug-fix. Both now carried by new deferred row 22.
• V4 — deferred item 4's own trigger fired inside the arc and the row was never updated; it still read "not introduced by this arc" after TRIM-009 changed both the guard's shape and its observable semantics. Now QUEUED.
• V5 — TRIM-008 was Done with 9 of 10 acceptance bullets unticked. All were satisfied (the auditor traced each); all now ticked.

Callouts

Fixed inline: a gate header still reading ClassAsyncBody_MARKER "expected PRESENT" while the code two lines below asserts its absence; a stale release-hold row; FactoryAttributes.cs's bolded CONTRACT stated absolutely where one leg is the exception; and AC5's self-cancelling wording, which demanded consumer proof and then made itself non-binding in its own parenthetical.

Queued as new rows: row 23 — two FactoryEventRelayTests tests pass vacuously under exactly the condition that reddens their siblings (they wait on InvocationCount == 1, then assert only Assert.Empty). Another check that cannot go red, inside the very class this arc has called a flake for five weeks — which makes item 10's "~3 of 8 runs" an undercount by construction. Item 11 widened: TRIM-009 routed its Step 7B to a row whose rationale doesn't cover a behavioural change.

What the audit verified

• AC1–AC3 trace to specific generator code and are proven in a publish-trimmed artifact, not inferred. AC3 was verified red first (TRIM-003) then fixed (TRIM-007).
• AC6 closes as written, not narrowed — five emission sites through one helper, three holder prefixes distinct at character 7, a CI gate with 11 positive controls and ~45 absence assertions across 8 legs plus 6 state-machine discriminators, and a liveness check proving the holders actually forward.
• 41 of 41 cited unit-test methods exist across all nine plans. Zero fabricated citations. Sacred-tests rule holds.
• Plan Index reconciles clean: 9 files, 9 rows, no orphans, abandonment reason filled, all three skipped gates carrying recorded reasons.

The auditor's fairest observation, worth keeping: earlier plans are honest but structurally weaker than the recent two — TRIM-001/002/007 ran real negative controls that were never archived, so a later reader cannot reproduce them the way 009-evidence/ allows.

Also in this PR

The arc's branching note still described the convention used by plans 001–007 (a shared TRIM integration branch). That was dropped at TRIM-008 and never updated — corrected, with the reason recorded: CI's pull_request trigger only watches main, so a PR into TRIM got no build at all, and holding docs on a long-lived branch is what let TRIM-005's falsified diagnosis sit unverified for a month. The TRIM branch itself has been deleted after confirming it held 0 commits not in main.

Verification

Docs and container only. build-main.log 0 errors; unit 614+614; integration 561+561 on re-run; Design 86+86; trimming gate exit 0; harness exit 0. Evidence archived under reviews/closeout-evidence/.

What remains after this merges

AC4 and AC5 are correctly still open. The remainder is the release itself: bump src/Directory.Build.props to 1.7.0, author docs/release-notes/v1.7.0.md including the synchronous-throw behaviour change with migration guidance (row 22 — commit-prefix scanning will not surface it), update the release-notes index, tag v1.7.0, let CI publish. AC4 closes there; AC5 is discharged by the release, with consumer rollout tracked in zTreatment PCB-003.

🤖 Generated with Claude Code