@@ -33,7 +33,7 @@ _Last updated 2026-10-09T03:52Z · main @ f3c6313_
 | C28 | 3 | socket.yml builds a hand-made YAML tree on serde-saphyr's event parser to read 8 keys. Target: serde with `deny_unknown_fields`. | 7.5 | | rejected; the tree implements the contract's scoped YAML refusals |
 | C29 | 3 | The `client.rs` split (2.8K lines) into client, vendor_service and credentials; the debug-ordering machinery (`HeldBack`) has 45 call sites. | 7.2; 7.6 #8 | #913 | filed #913; #871 deferred (closed not planned) |
 | C30 | 2 | No shared test-support: `binary()` is defined in 103 files and `git_sha256` in 86, there are 15 `scrub_socket_env` (14 bodies), xorshift is implemented four times, and the VEX helpers are forked. | 6.4; 8.5 D | #824, #823 | filed #824, #823; #850 deleted 8 of 15 `scrub_socket_env`; #824 children 2–3 fixed (#1124) |
-| C31 | 3 | There are 235 test executables on `b762f41` (review: 207; no `[[test]]` entries; 12 directory binaries exist); the target is ~25. This needs C10 first. | 8.5 A |  | to verify; count confirmed, not filed: blocked on #794 (env-mutating `#[serial]`) |
+| C31 | 3 | 240 test executables on `f3c6313` (review: 207); target ~25. Needs C10 first. | 8.5 A |  | to verify; count confirmed, not filed: blocked on #794 (env-mutating `#[serial]`) |
 | C32 | 3 | Tracking: ~478 one-line 4+-word `.contains` sentence assertions (245 in the 27 covgap files, 26,086 lines, 391 tests on `05ecc6e`) become `--json`/`errorCode` checks plus render suites; `_json`/`_human` twins collapse. | 2.5; 8.5 G/H | #1089 | filed #1089; tracking #1089 (#1090 folded in) |
 | C33 | 3 | Tracking: `CLI_CONTRACT.md` (417 KB on `431b818`; 332 KB at review) should be a checked reference (flags, env vars, codes, exit codes) plus ≤300 lines of prose, with freshness tests. | 8.3; 8.5 F/I | #948 | filed #948; tracking #948 (#949, #678 folded in) |
 | C34 | 3 | Decide: the command model. A read-only `scan`, plus `fix`, `undo`, `sync` and `check`, with mode inferred from project state (or an explicit `--mode` for takeovers). This folds `remove`, `rollback` and `vendor --revert`. | §4; 2.9; R6/R8 | #1088 | decision #1088; recommends mode-as-project-state now (Q1 option 2), new verbs next major |
@@ -73,7 +73,7 @@ _Last updated 2026-10-09T03:52Z · main @ f3c6313_
 | C74 | 3 | With no patch state (fresh project, or after a full `rollback`), `rollback` and `repair` exit 1 (`Manifest not found`/`manifest_not_found`) while `apply`, `vendor`, `vendor --revert` and `list` exit 0; a second v5 `rollback` exits 1, pinned by a test. | new finding | #1088 | decision #1088 (Q2) |
 | C75 | 2 | Every HTTP client trusts only reqwest's bundled webpki roots (no platform store, `SSL_CERT_FILE` or extra-CA knob), so behind a TLS-inspecting proxy the documented `HTTPS_PROXY` route fails with `UnknownIssuer` on every API, registry, telemetry and self-update call. | new finding | #1107 | filed #1107 |
 | C76 | 3 | `validate_paths` (#1029) refuses a directory manifest only when `--manifest-path` is spelled differently from the default: exit 2 with no `--json` output vs exit 1 `manifest_unreadable` for the same file. | new finding | #1123 | filed #1123 |
-| C77 | 3 | The VEX document (`vex --output`, embedded `--vex`) is written with `tokio::fs::write`, not the stage + rename writer: a failed write leaves a truncated OpenVEX file the stale-doc cleanup can't remove. | new finding | #1144 | filed #1144 |
+| C77 | 3 | The VEX document is written with `tokio::fs::write`, not stage + rename: a failed write leaves a truncated OpenVEX file the cleanup keeps. | new finding | #1144 | filed #1144 |
 | C78 | 3 | The hosted upstream restore sends every public-registry lookup at once (`join_all` in 5 formats); `utils::concurrent::registry_concurrency()` (cap 4, fd-tight 1) has no caller: 40 pins → 40 in flight. | new finding | #1220 | filed #1220 |
 
 **Handed off** (to the CI janitor): coverage de-instrumentation, the LTO `docker-base` build, a reusable compat workflow, per-leg compiles and dead CI path filters (review 8.2, 8.5 B/C/E).