docs(backlog): close two rows whose work is on main, and un-stale a third

[wshallwshall]

Closes two backlog rows whose work is already on main, and corrects a third that asserted the opposite of what shipped. Docs only, one commit, docs/BACKLOG.md alone.

Closed with evidence

#1392 — PR 609 had to land with or after ADR 0172. Both 6e0a950b6 (ADR 0172, 07:29:46Z) and 671d57501 (PR 609's edit, 08:31:45Z) are ancestors of origin/main under git merge-base --is-ancestor, an hour apart in the required order. Negative control: an invented sha, correctly refused. The ADR file is on main with its index row at docs/adr/README.md:197.

#1389 — a CI guard bound the wrong step. e9fa3b440 (PR #733) is an ancestor. Driving _engine_step_invocations() returns exactly one hit: job test, the engine step at ci.yml:852, not the tooling line at :1162. Two mutation controls fire; the unmutated file stays green.

Corrected, not closed

#1276 still claimed origin/main carries none of part A. That is false, and it is exactly the shape that costs a Builder a wasted dispatch. Sharpened in place; the row stays open because the audited re-mint genuinely does not exist — api/tls.py:114-117 says so itself.

How these were found

By running the subject-exists screen from PR 806 rather than writing another one. 14 candidates read: 2 closed, 6 partly shipped and correctly left open, 6 false positives. Every false positive came from a date-based signal firing on a landing the row already recorded; both closures came from date-free ancestry signals.

A control caught a fake pass

The first mutation battery reported PASS on both arms — because the replacement string never matched, so nothing was mutated. Printing whether the mutation changed bytes turned a fake pass into a real control. Separately, grep "always serves TLS" CLAUDE.md returned nothing and that negative was false: the phrase wraps a line break.

Known limitation, reported not hidden

The screen that produced these candidates is unsound under a shallow clone — its path-added-after signal reports the graft boundary as an add date, and the candidate list moves with clone depth. Detail is on PR 806. This triage used the deepened run.

Checks

backlog_status_check OK (657 items, each exactly one status; both closed rows carry zero open banners, no duplicate fields). link_check, backlog_citation_check OK. banner_sha_check has 10 findings, all on rows this diff does not touch; it caught one of mine and I fixed it.

pytest could not run in that worktree — no dependencies installed, ModuleNotFoundError: pydantic. The #1389 assertions were driven by loading the test module directly. Hosted-runner legs are unread from here.

Not done

#1107, #1130 and #1183 have shipped code but close on a vault scorecard re-score, which is not a Builder's act. They need a vault seat.

🤖 Generated with Claude Code

[wshallwshall]

Label disclosure, required by the Manager playbook

I applied the reviewed label on this pull request, and I commissioned the diff.

The playbook this seat works to is explicit that a label recording my read of work I asked for is not an independent read of the scope, and that a later auditor cannot tell the difference unless it is written down. So it is written down here.

What that means in practice:

• I read this diff and I stand behind what I checked.
• I am not an independent party. I wrote the brief that produced it, so the scope I checked against is the scope I chose.
• The owner has disabled the reviewer role and its tag requirement. This label satisfies a gate; it does not assert that a second party looked.

Where I posted a separate technical comment on this pull request, that comment names what I verified myself and what I took on the Builder's report. Where I did not, treat the label as attesting only that a read happened.