docs(testing): mark the vaulted tree so absence stops reading as evidence (BACKLOG #1435)

[wshallwshall]

Closes nothing. BACKLOG #1435 stays open — the gate half is deliberately not built, and why is the substance of this PR.

The problem

An item body cites a path under docs/testing/ or docs/security/ as though it were local. Those trees are gitignored — /docs/security/ is a blanket rule and docs/testing/ was tracked at exactly one file — so the real documents live in the separate vault checkout. From an engine checkout, work that is UNREADABLE is indistinguishable from work that is UNSTARTED. A reader greps, finds nothing, and concludes it was never done.

Measured three times in one day across two independent fleets: BACKLOG #1152 was about to claim it had satisfied a master-test-plan exit criterion it could never read; a peer fleet's #1193 found a sub-limb unreachable rather than undone; a peer fleet's #1191 found half an availability strategy vaulted.

What shipped

• docs/testing/README.md, tracked via a second negation under /docs/testing/*. It says the material moved and that absence is not evidence, and tells a grader to record such a limb as unverified — never as satisfied, never as missing.
• docs/README.md carries the same warning at the front door.
• tests/test_private_paths_stay_ignored.py pins the tracked pair as an exact set, so the marker cannot silently stop reaching fresh clones. Positive control: the pin failed before the marker was staged and passed after, so it genuinely reads git ls-files.
• A correction at docs/BACKLOG.md 4763/4771. #1011 step 6 called a vault-only file "the only place in the repo that records the true state" — false from any checkout. Both citations now name the unreadability in the same breath as the path, which is the remedy shape rather than a deletion.

The gate is not built, and that is the finding

Granularity	Cite	Unflagged
Per line	55	23
Per item body	27	2
Per item + master-test-plan	32	5

Three reasons, each sufficient:

1. Unscoped it reds about 22 times on day one, against a corpus nobody fixes in one PR.
2. The quiet variant measures the wrong thing. At 2 unflagged, item-granularity would ship comfortably — and it misses #1152, the motivating case, because that body flags the scorecard while leaving its master-test-plan clause unflagged. A gate quiet because it is aimed slightly wrong is worse than none: it converts an open problem into a false all-clear.
3. "Cites a vaulted path" overfires on prose about the arrangement and on count vocabulary, both of which CLAUDE.md permits. The real predicate is a citation a reader must follow in order to act — a judgement about intent that no pattern tried here expressed.

Both controls are written into #1435 so a future builder does not re-derive them: the fires side at 4763/4771 (recoverable from 024de5b68), and the quiet side in PRs 804 and 812, whose bodies carry the remedy shape and are not yet on main.

Disclosure

Nothing enumerates the vault. The marker names no vaulted document; the item names only what the public ledger already carries. A gate's failure message would be a disclosure surface too — naming the offending path would publish the map into CI logs and the workflow file, both public — and that constraint is recorded in the item.

Checks

backlog_status_check OK (658 items). link_check OK (5000 links). 182 passed across seven doc and ledger guard files. ruff check and ruff format --check pass; all pre-commit hooks green on all three commits. Interpreter provenance verified to read this worktree. Full suite and hosted-runner legs left to CI — no engine code changed, the only Python edit is one test file.

🤖 Generated with Claude Code