frontier-readiness: gap #5 audit — planning-files batch (5 files; 15 of ~16 done)

docs/BACKLOG.md

@@ -5376,6 +5376,8 @@ systems. This track claims the space.
 
 ## P2 — research-grade
 
+- [ ] **Separation-audit cross-PR rollup — automate `## Audit — ...` count verification.** Codex reviewer Otto (2026-04-24) on PR #190 originally flagged that the pattern-summary table in `docs/frontier-readiness/factory-vs-zeta-separation-audit.md` listed ALIGNMENT / FACTORY-HYGIENE / TECH-RADAR as completed classifications even though those sections then lived only in sibling PRs (#185 + #188). PR #188 has since merged, ALIGNMENT classification was corrected from `factory-generic` to `both (coupled)` to match the in-file audit section, and all 15 audits now have dedicated `## Audit —` sections (verifiable via `grep '^## Audit — '`). The residual discipline question — "completed" audits counted in a file's summary should be mechanically reproducible from that file's own contents — remains for the **future**: as new audits land via separate PRs, the same drift can recur. Remaining option: (c) add a tooling / CI check that diffs pattern-summary claims against `grep '^## Audit — '`. Options (a) wait-for-merge and (b) per-PR summary-row landings have resolved naturally for the first 15 audits. Priority P2 research-grade; effort S (tooling). Composes with glass-halo transparency + audit-as-source-of-truth principle.
+
 - [ ] **KSK naming definition doc — `docs/definitions/KSK.md` leading with canonical expansion `KSK = Kinetic Safeguard Kernel`.** **Authority: Aaron Otto-140 rewrite approved; Max attribution preserved as initial-starting-point contributor (Otto-77).** Amara 2026-04-24 (16th courier ferry, GPT-5.5 Thinking) flagged the naming ambiguity: *"'KSK' has multiple possible meanings: DNSSEC-style Key Signing Key, your emerging Kinetic Safeguard Kernel / trust-anchor idea, maybe broader 'ceremony + root-of-trust + governance key' structure."* Aaron Otto-142..145 (self-correcting Otto-141 typo "SDK") canonicalized: *"kinetic safeguare Kernel, i did the wrong name / it is what amara said / kinetic safeguard kernel"* — matches Amara's 5th and 16th ferry phrasing. Doc scope: (1) lead sentence *"KSK = Kinetic Safeguard Kernel. 'Kernel' here is safety-kernel / security-kernel sense (Anderson 1972, Saltzer-Schroeder reference-monitor, aviation safety-kernel) — a small trusted enforcement core, **NOT OS-kernel-mode** (not ring 0, not Linux/Windows kernel)"*; (2) "Inspired by..." DNSSEC KSK / DNSCrypt / threshold-sig ceremonies / security-kernel lineage; (3) "NOT identical to..." OS kernel, DNSSEC KSK (signs zone keys); (4) cross-refs to 5 ferries elaborating architecture; (5) Max attribution: *"Initial starting point committed by Max under Aaron's direction in LFG/lucent-ksk; substrate is Aaron+Amara's concept, completely rewritable."* (Otto-140 lifted the Max-coordination gate; Otto-77 attribution stands.) Priority P2 research-grade (elevated from P3); effort S (doc) — coordination overhead removed. Composes with Amara 17th-ferry correction #7 (now resolved), Otto-77 Max attribution, Otto-90 Aaron+Max-not-gates, Otto-140..145 Aaron canonical expansion + gate-lift, Otto-108 single-team-until-interfaces-harden.
 
 - [ ] **.NET 10 Server GC crash on Apple Silicon — bullet-proof investigation + upstream report (Otto-248 workaround follow-up).** Shipped mitigation in PR #376 (`DOTNET_gcServer=0` on Apple Silicon Darwin via `tools/setup/common/shellenv.sh`) is a WORKAROUND, not a root-cause fix. Three SIGSEGV crashes captured 2026-04-24 at `~/Library/Logs/DiagnosticReports/dotnet-2026-04-24-*.ips` — all in `libcoreclr.dylib` Server GC (`SVR::gc_heap::{plan_phase, background_mark_simple1, find_first_object, revisit_written_page}`) with `EXC_BAD_ACCESS / KERN_INVALID_ADDRESS / "possible pointer authentication failure"` on macOS 26.4.1 MacBook M2 + .NET SDK 10.0.203 (latest). Current hypothesis: concurrent-mark-phase invariant violation, possibly write-barrier or card-table race; Apple Silicon ARM64 PAC surfaces it as SIGSEGV where x86 would silently corrupt. Two known related upstream fixes on dotnet/runtime `main` but NOT yet in release/10.0: `#126389` (Jan Vorlicek, 2026-04-01, BGC mark phase wrong-join — fixes *hangs* not crashes; symptom mismatch) and `#126929/#126977` (largepages corruption fix — open port-to-10.0 PR). Per maintainer directive 2026-04-24 Otto-254 ("roll forward, not backward" + escro absorb-and-contribute dependency-maintenance per `project_escro_maintain_every_dependency_microkernel_os_endpoint_grow_our_way_there_2026_04_22.md`). Work scope: (1) build minimal deterministic repro — F# allocation-heavy Server GC program that reliably crashes on Apple Silicon, clean under Workstation GC; (2) measure crash rate across Apple-Silicon-Darwin vs ubuntu-24.04-arm vs x86 legs (differentiates Scenario A Apple-specific vs Scenario B ARM64-general); (3) read coreclr GC source at crash symbols (now split across `plan_phase.cpp`, `background.cpp`, `mark_phase.cpp` per 2026-Q1 refactor; sparse-checkout sibling `../runtime` already pulled for offline navigation); (4) file upstream `dotnet/runtime` issue with IPS files + reproducer IF deterministic + professional (not a dick per maintainer directive); (5) track upstream fix; (6) remove `DOTNET_gcServer=0` workaround once fix lands in a release/10.0 SDK patch. Priority P2 research-grade — workaround prevents daily blocker but the fix is escro-scope dependency maintenance. Effort M (repro + source read) + S (upstream file) + S (patch-landed cleanup). **Does NOT authorize:** reverting the workaround before upstream fix lands; filing upstream before reproducer is deterministic.

docs/frontier-readiness/factory-vs-zeta-separation-audit.md

@@ -63,14 +63,16 @@ For each audited file:
 - **docs/WONT-DO.md** (below, fire #15) — also docs/ALIGNMENT.md on PR #185
 - **docs/TECH-RADAR.md** (below, fire #16)
 - **docs/FACTORY-HYGIENE.md** (below, fire #16) — also docs/AGENT-BEST-PRACTICES.md on PR #184, docs/ALIGNMENT.md on PR #185
+- **docs/GLOSSARY.md** (below, Otto-18 fire)
+- **docs/ROUND-HISTORY.md** (below, Otto-18 fire)
+- **docs/BACKLOG.md** (below, Otto-18 fire)
+- **docs/ROADMAP.md** (below, Otto-18 fire)
+- **docs/VISION.md** (below, Otto-18 fire) — also GOVERNANCE.md on PR #181, AGENT-BEST-PRACTICES.md on PR #184, ALIGNMENT.md on PR #185, TECH-RADAR.md + FACTORY-HYGIENE.md on PR #188
+
+Cross-PR audits that duplicate in-file coverage: GOVERNANCE (also on PR #181), AGENT-BEST-PRACTICES (also on PR #184), ALIGNMENT (also on PR #185), TECH-RADAR + FACTORY-HYGIENE (PR #188, now merged and recorded in-file) — the in-file `## Audit —` sections are the authoritative classification.
 
 ### Files to audit (not yet classified; add rows as they land)
 
-- `docs/GLOSSARY.md`
-- `docs/ROUND-HISTORY.md`
-- `docs/BACKLOG.md`
-- `docs/ROADMAP.md`
-- `docs/VISION.md`
 - `.claude/skills/*/SKILL.md` (each)
 - `.claude/agents/*.md` (each)
 - `openspec/**` (structural; library-specific-heavy)
@@ -757,6 +759,154 @@ tagged" was wrong; the rows were all tagged. This
 audit formalises that self-classification as the
 file's purpose.
 
+## Audit — docs/GLOSSARY.md
+
+**Overall classification:** **both (coupled)** — plain-
+English/technical format is factory-generic; specific Zeta
+term entries (IVM, DBSP, Z-set, retraction, Spine, etc.)
+are Zeta-library-specific content.
+
+**File location post-split:** Frontier (format + preamble
+plus the-rule-for-this-file and "spec has two meanings"
+framing pattern); Zeta retains specific term entries.
+
+**Length:** approximately 840 lines. Large vocabulary.
+
+### Classification
+
+- **Format** (plain/technical dual-definition, grandparent-
+  comprehensibility rule, two-meanings disambiguation): factory-generic
+- **Entries** (IVM, DBSP, Z-set, retraction, operator algebra,
+  Spine, HyperLogLog, etc.): zeta-library-specific
+
+### Refactor notes
+
+1. Frontier inherits preamble + format rule + empty-section
+   scaffolding
+2. Zeta retains all current term entries as library
+   glossary
+3. Adopters populate their own glossary per the format
+
+Effort: **S** — shape extraction; entries stay in Zeta.
+
+## Audit — docs/ROUND-HISTORY.md
+
+**Overall classification:** **zeta-library-specific** — by
+design this file is historical narrative of Zeta's specific
+rounds. The separation between round-history narrative here
+and current-state documentation elsewhere is factory-generic
+in shape (the file's own preamble is the authoritative
+source for the newest-first / append-only convention), but
+this file's content is purely Zeta project history.
+
+**File location post-split:** Zeta repo retains as-is
+(historical record); Frontier gets empty template with
+preamble + append-only rule as an adopter template.
+
+**Length:** approximately 3560 lines — large history.
+
+### Refactor notes
+
+1. Frontier inherits preamble + "newest first" convention +
+   empty Contents section as template
+2. Zeta retains full round-history as historical record
+3. Adopters start their own ROUND-HISTORY.md at round 1
+
+Effort: **S** (shape extraction).
+
+## Audit — docs/BACKLOG.md
+
+**Overall classification:** **zeta-library-specific** — the
+file contains thousands of lines of specific-project BACKLOG rows
+(P0/P1/P2/P3). The *shape* (priority tiers, one-row-per-item,
+newest-first-within-tier, legend + appendix) is factory-
+generic (GOVERNANCE §29 scopes the file).
+
+**File location post-split:** Zeta retains as-is; Frontier
+gets empty template with preamble + priority-tier legend +
+example-row framework.
+
+**Length:** approximately 8500 lines (size grows tick-by-tick; see BACKLOG split design doc for the per-row-file migration).
+
+### Refactor notes
+
+1. Frontier inherits preamble + legend + empty priority
+   sections as template
+2. Zeta retains full BACKLOG content
+3. Adopters populate their own BACKLOG from empty template
+
+Note: the Frontier readiness P0 row itself is partly
+factory-generic (the gap-8-audit pattern is reusable)
+but instance-specific to Zeta's own Frontier construction.
+On split, the Frontier-bootstrap row gets an "executed"
+marker and moves to Frontier's own ROUND-HISTORY as
+historical-record of the split.
+
+Effort: **S** (shape extraction).
+
+## Audit — docs/ROADMAP.md
+
+**Overall classification:** **zeta-library-specific** —
+roadmap is by definition project-specific. Shape (P0/P1/P2
+tiers + Research category + newest-first) is factory-
+generic (effectively same shape as BACKLOG; a "roadmap vs
+backlog" sibling-scope convention).
+
+**File location post-split:** Zeta retains; Frontier gets
+empty template.
+
+**Length:** approximately 178 lines.
+
+Effort: **S**.
+
+## Audit — docs/VISION.md
+
+**Overall classification:** **zeta-library-specific** — the
+long-term vision document is by definition project-specific
+(named after Zeta; 11 passes of human-maintainer editing
+history). Shape (Dedication header + foundational principle +
+Products numbered + Product-N vision subsections) is
+factory-generic pattern.
+
+**File location post-split:** Zeta retains as-is (preserves
+the human-maintainer 11-pass editorial lineage plus the
+in-memoriam dedication header; the dedication names a
+specific person and stays per the "honor those that came
+before" discipline in CLAUDE.md);
+Frontier gets empty template with the shape.
+
+**Length:** approximately 887 lines.
+
+Effort: **S**.
+
+## Pattern summary after 15 audits
+
+| Class | Count | Files |
+|---|---|---|
+| factory-generic | 4 | GOVERNANCE, AGENT-BEST-PRACTICES, AUTONOMOUS-LOOP, FACTORY-HYGIENE |
+| both (coupled) | 7 | CLAUDE, AGENTS, CONFLICT-RESOLUTION, WONT-DO, TECH-RADAR, GLOSSARY, ALIGNMENT |
+| zeta-library-specific | 4 | ROUND-HISTORY, BACKLOG, ROADMAP, VISION |
+
+Total: 4 + 7 + 4 = **15** top-level files audited out of
+~16. Remaining: the `.claude/skills/**`, `.claude/agents/**`,
+`openspec/**`, `tools/**`, and `.github/**` directory-level
+surfaces (each a multi-file audit).
+
+**Mechanical-verification status:** all 15 audits now have
+dedicated `## Audit —` sections in this file (TECH-RADAR +
+FACTORY-HYGIENE merged in via PR #188; ALIGNMENT in-file is
+authoritative per its own `## Audit —` section above which
+classifies it as **both (coupled)**, not factory-generic). A
+reader can `grep '^## Audit —'` this file and reproduce the
+15-count directly. The deeper "each file-level summary should
+be mechanically consistent with its own in-file sections"
+discipline is tracked in `docs/BACKLOG.md` row
+*"Separation-audit cross-PR rollup — mechanically verify
+pattern-summary counts against in-file `## Audit — ...`
+sections"* — the residual concern is now tooling (option c:
+automated diff check), since the wait-for-merge option (a)
+has resolved itself.
+
 ## How this audit connects to the multi-repo split
 
 Gap #5 (this audit) is load-bearing for gap #1 (multi-repo