docs: record backend revalidation dispositions

docs/execution/approved-issue-plans-ledger.md

@@ -29,12 +29,12 @@ state changes are outside scope.
 
 | Unit | Issues | Status / current validity | Owner | Worktree / branch | Base → head | Dependencies | Evidence | Tests | PR | Next action | Blockers |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| 01 account login/recovery | #3166, #3164, #3078, #3046, #2897, #2837 | pending | unassigned | — | `7a98f6662` → — | none | live revalidation pending | — | — | inspect full plan, issue history, current auth seams; reproduce per gates | private/hosted evidence may gate historical claims |
-| 02 hosted v4 recovery | #3181, #2760 | pending | unassigned | — | `7a98f6662` → — | unit 01 evidence | live revalidation pending | — | — | validate scoped ownership/recovery direction | legitimate private recovery access and backups |
-| 03 MCP registration | #3398, #3153 | pending | unassigned | — | `7a98f6662` → — | none | live revalidation pending | — | — | verify OAuth persistence fix and residual registration path | hosted/provider access may limit end-to-end proof |
-| 04 AI provider compatibility | #2732, #2766, #2723, #2708 | pending | unassigned | — | `7a98f6662` → — | none | live revalidation pending | — | — | isolate connect, enablement, and import causes | provider credentials/fixtures may gate cases |
-| 05 AI provider migrations | #3152 | pending | unassigned | — | `7a98f6662` → — | coordinate with 04 | live revalidation pending | — | — | inspect deployment migration path and current schema | self-hosted deployment evidence may gate historical claim |
-| 06 image storage delivery | #2684, #2778 | pending | unassigned | — | `7a98f6662` → — | coordinate with 15/25 | live revalidation pending | — | — | verify local/S3 upload and PDF delivery boundaries | backend fixtures/infrastructure |
+| 01 account login/recovery | #3166, #3164, #3078, #3046, #2897, #2837 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | none | zero drift; live issues remain split; #3046/#3078 have merged #3095 candidate only | auth 42, email 6, focused/full API/server suites and affected typechecks/boundaries passed in audit | — | select exact auth/mail/API boundary only after current sanitized trace | current cloud digest, provider/account method, request/status trace, controlled mailbox |
+| 02 hosted v4 recovery | #3181, #2760 | implementing partial source unit | `task_bae016c4d1f2` / `ctx_303f5d1f1031` | `issue-3181-recovery-procedure`; target `codex/issue-3181-recovery-procedure` | `7a98f6662` → pending | #2760 identity branch depends on 01 evidence | zero drift; synthetic non-networked runbook/tool ready; real recovery and #2760 cause unproved | implementation verification pending | — | build pure compare tool and safeguards docs; independently review | actual recovery needs verified owner, available snapshot, reviewed legacy format, authorized private delivery |
+| 03 MCP registration | #3398, #3153 | no-change | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate DB/startup with 05 | merged #3421 (`fe9b59e`) present on main; current schema/startup/auth contracts match plan | #3421 hosted checks successful; audit auth/server/API/DB tests, typechecks, boundaries passed | #3421 merged before run | deployment verification only | deployed digest/log correlation and exact Codex/Claude DCR/consent/PKCE/MCP retest unavailable |
+| 04 AI provider compatibility | #2732, #2766, #2723, #2708 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | serialize edits to AI service | zero drift; historical #2708 Responses path and #2766 structured Test path absent; remaining tuples differ | focused API 96 and full API suites/typecheck/boundaries passed in audit | — | select wire/state/import/base-path unit only after exact current tuple fails | provider/model/base URL/path/version/action/error tuple and allowed endpoint unavailable |
+| 05 AI provider migrations | #3152 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate DB/startup with 03 | zero drift; table schema, migration, startup ordering, Docker copy path coherent; `42P01` historical cause unresolved | audit API/server/DB tests, typechecks, boundaries passed; no real PostgreSQL migration fixture | — | choose config/packaging/startup/migration repair only after disposable reproduction | affected image layout/digest, working directory, DB schema/search path/journal, fresh+upgrade DB fixture |
+| 06 image storage delivery | #2684, #2778 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate 12/15/25 renderer/image fixtures | #2684 ACL cause fixed by merged #3432 (`35cecf9`); #2778 Browserless path obsolete; current topology unproved | #3432 hosted checks successful; audit storage/upload/PDF tests, typechecks, boundaries passed | #3432 merged before run | deployment retest plus shared real-encoding/backend/render fixture before repair | deployed digest; disposable S3/Garage/SeaweedFS/MinIO/proxy and browser/server raster matrix unavailable |
 | 07 AIO deployment | #2722 | pending | unassigned | — | `7a98f6662` → — | none | Q12: PostgreSQL remains separate | — | — | record declined AIO direction; inspect Compose/Unraid docs; improve only proven gaps | no AIO implementation permitted |
 | 08 root public resume | #2669 | pending | unassigned | — | `7a98f6662` → — | none | live revalidation pending | — | — | verify self-hosted root routing proposal against current routes | — |
 | 09 external version backup | #2705 | pending | unassigned | — | `7a98f6662` → — | none | live revalidation pending | — | — | document explicit JSON backup in user-controlled Git | no automatic sync scope |
@@ -69,13 +69,14 @@ state changes are outside scope.
 
 | Scope | Task / dispatch | Owner worktree | State | Deliverable |
 | --- | --- | --- | --- | --- |
-| Plans 01–06 | `task_855fbee0a803` / `ctx_949458744061` | `codex-audit-backend-01-06` | diagnosing | current issue/source/PR audit and executable unit split |
+| Plans 01–06 | `task_855fbee0a803` / `ctx_949458744061` | `codex-audit-backend-01-06` | complete; worker released | zero drift; plans 01/04/05/06 blocked on named evidence; plan 03 no-change; plan 02 synthetic unit ready |
 | Plans 07–11, 35 | `task_9f27829ca50f` / `ctx_11f7d7cf6d17` | `codex-audit-backend-07-11-35` | diagnosing | current issue/source/PR audit and executable unit split |
 | Plans 12–19 | `task_1c6582ccdeae` / `ctx_795fced595ef` | `codex-audit-rendering-12-19` | diagnosing | current issue/source/PR audit and renderer overlap map |
 | Plans 20–34 | `task_47ed7eb02d48` / `ctx_50d8257459ab` | `codex-audit-builder-20-34` | diagnosing | current issue/source/PR audit and schema/template overlap map |
 | Plan 07 implementation | `task_aee702e37eae` / not dispatched | planned `codex/issue-2722-postgres-docs` | waits on plans 07–11 audit | two-file docs change, verification, commit, independent review |
 | Plan 09 implementation | `task_e450ea143bfa` / not dispatched | planned `codex/issue-2705-git-backup-docs` | waits on plans 07–11 audit | two-file docs change, synthetic local-Git validation, commit, independent review |
 | Plan 11 implementation | `task_58d76423d364` / not dispatched | planned `codex/issue-3010-jsearch-docs` | waits on plans 07–11 audit | three-file docs change, source/test validation, commit, independent review |
+| Plan 02 synthetic recovery | `task_bae016c4d1f2` / `ctx_303f5d1f1031` | `issue-3181-recovery-procedure`; target `codex/issue-3181-recovery-procedure` | implementing | pure deterministic compare tool, safeguards docs, TDD evidence, commit, independent review |
 
 ## Existing PR and residual accounting