docs(handoff): espanso close-out — guards gone (#1265), and I merged a wrong diagnosis that #1275 retracts

[ZacxDev]

Close-out update for the espanso-audit-gate effort — updated in place, same slug.

What changed since the doc was written

#1265 merged (68d10b19) — the ten live-config guards are gone. test_espanso_detect.py is 60 tests, 0 live guards. #1270 (1cc08ff8) and #1275 (aba48864) also merged, all content-verified.

Nothing now checks that a snippet edit preserves attribution. Stated in the doc rather than left implicit, along with the deciding evidence — which inverts the intuition and is the part worth not re-deriving: the guards were green through the regression they existed to catch. _AUDIT_2026_08_19_RESOLUTIONS pins rig/portable — the words the rename introduced — so it passed while 'ssh work nebula' went from one picker row to zero. Cost: four reddenings of main on legitimate config edits. Benefit: did not fire.

_attribute's logic keeps full hermetic coverage (mutation-verified: the three branches redden 5, 5 and 4 survivors). Only config-data integrity was dropped.

🔴 A closed investigation recording my own wrong diagnosis

I merged a "LIVE TELEMETRY GAP" claim into this doc that was wrong on its mechanism and its fix; #1275 retracted it. The block records what happened and the reusable shape:

A measured value with an unmeasured explanation attached. Every None I reported was real. The sentence saying why — "nebula/mesh are not in either snippet's search_terms" — was never checked, and they are in both. Three audit rounds re-derived the values and confirmed them; none re-derived the explanation, because it read as a restatement of the measurement rather than a separate claim. It passed a ladder built specifically to catch claims that certify rather than omit, then passed a merge.

Carried forward at the write-gate's prompting

It flagged four durable lines a REPLACE would drop; three were not covered by the replacement and are carried: the enforceable correction (#1247+#1252) — code, survives #1265, but now with zero live instances; the operator decision verbatim; and the #1262 reconciliation, where a clean textual merge would have imported a false "nothing was lost" accounting.

Two new ranked items

9 (forcing: regression) — 🔴 #1256 is open and main's skill-chain doc is stale: it still says #1219 is "OPEN as of 2026-09-01" and carries the pre-#1219 partition. Verifiable in one grep, which returns 0 today. That is this arc's own defect class, live. 10 (forcing: none) — decide the :ssh* search words; a preference, not a repair.

No clawgate-task: field — resolve exited 5 (0 tasks), which cannot distinguish "touched no task" from "wrong id". Not a clean bill of health.

🤖 Generated with Claude Code