[stphung]

Summary

• src/utils/CLAUDE.md: mod.rs row claimed it re-exports all public types from submodules, but bug_report is declared without a pub use — callers reach it via crate::utils::bug_report::.... Doc now states the three modules it actually re-exports.
• src/main_helpers/CLAUDE.md: mod.rs row claimed "public re-exports" exist, but the file is pure pub mod declarations with no re-exports at all — every consumer uses the submodule path.
• src/input/CLAUDE.md: collapsed four distinct numbered dispatch steps in the input priority chain (Steps 2, 2.5, 2.7, 2.8 — Haven, Soulforge, Stormglass Exchange, The Deep) into a single "Step 2" entry, inconsistent with every other step in the same list matching the code's actual step numbers.

Found by a full 6-agent /doc-audit run across CLAUDE.md, docs/, docs/dossiers/, all src/*/CLAUDE.md files, and README.md (commit 2f0002cc5fd08bef3c4ce0ad55e05724a7f90e56). These three were the only discrepancies found; everything else audited clean.

Test plan

• cargo fmt --check passes
• Docs-only change — no source/behavior change, no targeted test row applies
• Note: make check's security-audit step independently fails on the pre-existing zip 8.6.0 RUSTSEC advisories (RUSTSEC-2026-0367/368/369), unrelated to this change — Cargo.lock isn't committed so this affects main identically; out of scope for this doc-only PR.

---

Generated by Claude Code

[stphung]

Audit check is failing (cargo audit --deny yanked), but it's not this PR's — this is a docs-only change (no Cargo.toml/Cargo.lock touched).

Root cause: Cargo.toml pins zip = "8.5" (semver range) and Cargo.lock isn't committed to this repo, so every cargo audit run resolves to the newest compatible zip release at run time — currently 8.6.0. Three RUSTSEC advisories against zip 8.6.0 were published 2026-10-09/10 (after the last green main run on 2026-10-12, which is why it wasn't caught then):

• RUSTSEC-2026-0367 (7.3 high) — SUID/SGID bit preservation during extraction
• RUSTSEC-2026-0368 — symlink target escapes destination directory
• RUSTSEC-2026-0369 (9.1 critical) — Unix permissions applied through symlinks without confining the target

All three require zip >= 9.0.0 to fix, which is a major-version bump the prior dependency-audit run (#821, 2026-10-12) already flagged for human review as a breaking API migration — no fix exists yet. This affects main identically (it would fail the same cargo audit run today), so it isn't something to fix from this docs-only PR. Recommend a dedicated dependency-audit pass to do the zip 9.x migration. No re-run needed — this is a real, deterministic finding, not a flake.

---

Generated by Claude Code