chore: prepare the repo for public use

.claude/commands/audit-deps.md

@@ -219,7 +219,7 @@ For each approved major, one at a time:
 
 ## Phase 9 — Report, persist, commit
 
-**Report** (in chat, and written to `.claude/reports/deps-audit-<YYYY-MM-DD>.md`):
+**Report** (in chat, and written to `.claude/reports/deps-audit-<YYYY-MM-DD>.md`, which is gitignored: a local working copy, never committed — the durable record is `deps-known-issues.md`):
 
 ```markdown
 # Dependency Audit — <date>
@@ -263,8 +263,8 @@ longer applies. Keep dates on everything.
 - Separate commits per tier so a bisect is meaningful:
   - `fix(deps): resolve <N> advisories via in-range updates`
   - `chore(deps): bump <pkg> <old> -> <new>` (one per major)
-  - `docs(deps): audit report <date>`
-- Include the report path and the verification results in the commit body.
+  - `docs(deps): update known issues <date>`
+- Include the report summary and the verification results in the commit body.
 - Sign off as configured in CLAUDE.md's commit conventions.
 - **Do not push and do not open a PR.** Tell the user the branch is ready.
 

.claude/playbooks/port-security-review-2026-09-28.md

@@ -511,7 +511,7 @@ git show e17c55e           # SessionContextService rethrows Next control-flow er
 
 Reference docs in the upstream repo:
 
-- `.claude/TODO/security-review-2026-09-28-index.md`: the review record (every item, decisions, and what was checked and held)
+- `docs/security/2026-09-28-auth-review.md`: the review record (every item, decisions, and what was checked and held)
 - `docs/security/downstream-hardening-playbook.md` § 2026-09-29 follow-up: the human-readable summary
 - `docs/security/Additional_Security_Hardening.md`: the open policy options (revocation, MP login re-validation, role granularity)
 - `.claude/references/auth.md`: session lifetime, emergency sign-out, authorization policy, the per-process caveats

.claude/references/deps-known-issues.md

@@ -3,8 +3,8 @@
 State carried between `/audit-deps` runs so each audit starts from prior conclusions
 instead of re-deriving them. Every entry needs a date and a re-check trigger.
 
-Last audit: **2026-08-27** — report at `.claude/reports/deps-audit-2026-08-27.md`
-(prior: `deps-audit-2026-08-21-run2.md`, `deps-audit-2026-08-21.md`).
+Last full audit: **2026-08-27** (prior: 2026-08-21, twice). Per-run reports are local
+working files (`.claude/reports/`, gitignored); this file is the durable record.
 
 Advisory state re-verified **2026-09-12** (release docs pass — read-only, no
 upgrades applied): `npm audit` reports **0 vulnerabilities across 720 packages**

.claude/references/testing.md

@@ -845,19 +845,13 @@ production), `procedure.service.test.ts` (stored procedures can mutate data), an
 
 ## Deferred Issues
 
-Defects and refactors found while testing are documented one-per-file in
-`.claude/TODO/`, not fixed silently. **Every test-derived TODO is now closed** —
+Defects and refactors found while testing were documented, not fixed silently.
+**Every test-derived item is now closed** —
 filter injection via numeric IDs, the two unauthenticated `'use server'` actions,
 the missing authorization gate, the `SessionContextService` refactor, the N+1
 lookup, the token lifetime, and the untested contact-log component. See
-`.claude/docs/TestCoverage.md` §5 and §6 for each one. `.claude/TODO/` holds a
-single open item, `investigate-setup-check-stale-model-detection.md`, which is a
-setup-wizard issue with no bearing on the suite.
-
-Five test files still carry `Regression guard for .claude/TODO/<x>.md` comments
-naming TODO files that have since been deleted (`mp-filter-injection-numeric-ids.md`,
-`n-plus-1-contact-log-types-lookup.md`, `contact-logs-component-untested.md`).
-The assertions are correct; only the breadcrumbs are dangling.
+`.claude/docs/TestCoverage.md` §5 and §6 for each one. The tests that pin those
+fixes carry `Regression guard for …` comments naming the fix.
 
 Those assertions are now specifications rather than snapshots — `should NOT
 delete when the caller holds no security role` and `should permit editing a log