docs(backlog): reconcile four research banners with what merged today (BACKLOG #1122, #1169, #1182, #1188)

[wshallwshall]

What this is

A ledger audit, not a build. Four research rows -- #1122, #1169, #1182 and #1188 -- opened with a Filed 2026-08-08 - not started line while the work they name had already merged to main. This corrects their banners. No code changed; the diff is 7 added lines in docs/BACKLOG.md.

Measured by content, because ancestry cannot answer this here

This repository squash-merges and deletes branches, so merge-base --is-ancestor returns false for work that landed and ls-remote shows no branch. Both readings are indistinguishable from genuinely unmerged work. Every claim below was therefore established by grepping a distinctive anchor at origin/main and at the merge's own parent, with a fabricated token as the negative control returning nothing anywhere.

Item	Merged	Commit	PR	Anchor present on main, absent at merge parent
1122	2026-09-05	b66c9db8	875	_is_safe_top_level_navigation in messagefoundry_webconsole/_security.py
1169	2026-09-05	5692aeca	877	reseal_to_active in messagefoundry/uploads.py
1182	2026-09-05	30d5da10	863	static_credential_db_hops in messagefoundry/config/wiring.py
1188	2026-09-05	162e7802	869	the dropped stage predicate in purge_dead_letters, all three backends

All four PRs read MERGED from gh pr view, with merge commits matching the shas above.

What each banner said, and why the four are not the same case

Three of the four recorded the build only in their PROSE. The banner block is the region every tool reads -- parse_items exposes it and the dispatch gate consults it -- so a reader who stopped there saw a filing snapshot and nothing else. #1188 is different: its banner already carried a dated build note, but the note was written while the change was still in flight and names no commit, so it could not be verified from the row. Its addition is one line of evidence rather than a restated finding.

What remains, per row

The re-score is not the only remaining act on any of the four. Engine work remains on all four, and two also carry an open owner decision.

• #1122 -- the console limb merged. The engine limb was not started and is an owner funding decision across the safe-method JSON API routes. Three route-level navigation gates on the federated-login paths are named and untouched. Failing closed on an absent header is declined with a measurement, and its stated precondition is a supported-browser matrix the tree does not have.
• #1169 -- the three preconditions merged. The refusal itself is not built at either cipher implementation, and it is gated on the re-put owner ruling this item asks for on the DIRECT enveloped surface. The four _reencrypt_value spellings, the per-backend composite-pass lists and the costed DIRECT integrity option are also open.
• #1182 -- the inventory merged. The refusing gate was deliberately not built, for this item's own recorded reason. The [alerts] webhook sink declares no credential field of any kind, so on a first deployment no operator configuration would authenticate that hop. The item's other named hops have not been re-measured on the same footing, and the per-backend scoping question stays the owner's.
• #1188 -- one of the named builds merged. Everything else the row lists is still open and is already stated in the row.

Who closes them

Each row carries Closing-act: scorecard-rescore. That act happens in the separate vault clone and is not a Builder's to perform, so none of these rows can close on this PR. The banners cite CLAUDE.md section 5 for the seat rather than restating the ruling.

Findings this PR deliberately did not act on

• scripts/docs/backlog_status_check.py maps closing-act: scorecard-rescore to a seat that CLAUDE.md section 5 lists as retired. It is a docstring constant, not a gate, and editing it here would collide with a sibling lane working .github/. Recorded for whoever owns that file.
• banner_sha_check.py exits 1 over the live corpus on #1094 in the closed archive, and verdict_divergence_check.py exits 1 on backlog: close #1222 -- the fix shipped in ddee5c1d and the banner outlived it #340, #1003 and #1266. Neither names any of my four rows, and neither runs as a gate in .pre-commit-config.yaml or a workflow. Pre-existing and out of scope.

Decisions this brief left open

1. Where the new lines go. Inside the banner block, after Research: and above the filing line, carrying no status glyph -- the pattern #1188 already shipped in this file. The alternative, rewriting the Filed 2026-08-08 - not started opener, would destroy a dated snapshot; a dated 2026-09-05 line above a dated 2026-08-08 line reconciles it without that loss.
2. Not restating what the prose already says. Each addition points at the prose section that carries the measurements instead of copying it. Same reason for #1188's minimal one-liner.
3. PR 875 rather than #875. A bare #N is ambiguous between a pull request and a backlog item in this repo, and the ledger's own citation checks say so.

Checks

Run in this worktree with the interpreter at C:/Users/Scott/Code/MessageFoundry/.venv/Scripts/python.exe. That venv resolves messagefoundry to THIS worktree (printed and read, not assumed), and every test below resolves its corpus from Path(__file__).resolve().parents[1], which is also this worktree.

Check	Result
ruff check .	0, all checks passed
ruff format --check .	0
mypy messagefoundry (strict)	0, no issues in 268 source files
pytest backlog + ledger suites (6 files)	135 passed
pytest doc-guard + dispatch-gate suites (6 files)	126 passed
backlog_status_check.py	0, 670 items each declaring exactly one status
backlog_citation_check.py	0, 2 pre-existing advisory warnings
link_check.py, dangling_citation_check.py	0
parse_items before/after	status, score and all three fields byte-identical on all four rows; item count unchanged at 433
pre-commit hooks at commit time	all wired hooks passed

Not run: the full suite, and every leg that only exists on a hosted runner. windows-service-smoke and the SQL Server and Postgres legs are named here because a Builder never sees their result. This change touches one Markdown file and no code path any of them exercises.

One instrument correction worth recording: the first pass read $? after a pipe and scored banner_sha_check and verdict_divergence_check as exit 0. They exit 1. Re-read without the pipe, which is how the two pre-existing findings above were found.

Claims

Held on 1122, 1169, 1182 and 1188, all four still held because the rows stay open and this PR is unmerged. None released.

Generated with Claude Code (https://claude.com/claude-code)

[github-actions]

@wshallwshall

This pull request is green and nobody has marked it read.

Every check that has reported is passing and the reviewed label is absent, so
a reviewer has read this is the only thing between it and a merge. Nothing else reports that, which is
why this comment exists (BACKLOG #1413).

To clear it, IN THIS ORDER:

1. If the branch is behind main, update it FIRST: gh pr update-branch --repo MEFORORG/MessageFoundry 935.
   That push fires synchronize, and synchronize REMOVES the reviewed label. Labelling
   before updating throws the label away and costs a round trip.
2. Read the diff.
3. gh pr edit 935 --repo MEFORORG/MessageFoundry --add-label reviewed

DO NOT TRIAGE THIS FROM mergeStateStatus. It returns one value with precedence, so BEHIND,
DIRTY and UNSTABLE each mask the missing check -- the requirement is invisible until you act on
something else. This check never reads that field; see scripts/ci/check_unread_prs.py.

A seat can find every pull request in this state in one call: gh pr list --label unread.
The label is withdrawn automatically once this pull request leaves the state.

The reviewed label is a PROCESS gate. It records that a step happened. It does not
establish that an independent party looked, and nothing here should be read as saying it does.